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APOLLO EXPERIENCE REPORT 
GUIDANCE AND CONTROL SYSTEMS: 
LUNAR MODULE ABORT GUIDANCE SYSTEM 


By Pat M. Kurten 
Lyndon B. Johnson Space Center 


SUMMARY 


With respect to the lunar module abort guidance system, the Apollo Program 
experience included the full range of program development from requirements through 
design, development, and production and culminated with successful flight. As a 
result of preliminary lunar-abort concepts, a strapped-down inertial-sensor package 
for attitude reference and an open-loop programer were selected to provide ascent 
steering for lunar-orbit insertion. A clear pericynthion orbit could be obtained by 
postinsertion burns, and rendezvous was to be accomplished by means of external 
information. A program redefinition in 1964 added the requirement for a clear peri- 
cynthion orbit from the initial abort burn and the requirement for a rendezvous within 
the lunar module fuel budget without information from sources outside the lunar 
module. The required accuracy of the strapped-down package was therefore increased, 
and a general-purpose digital computer containing 4096 words of memory replaced the 
open-loop programer. A display and keyboard device was added for crew communica- 
tions with the computer. 


INTRODUCTION 


The lunar module (LM) abort guidance system (AGS) represents the first opera- 
tional usage of a strapped-down guidance system. The AGS was designed and developed 
specifically for application in the Apollo LM. The AGS is composed of a strapped-down 
(or fixed) inertial-sensor package, the abort sensor assembly (ASA); a general-purpose 
digital computer with specialized input/output, the abort electronics assembly (AEA); 
and a display and keyboard device for crew communication with the computer, the data 
entry and display assembly (DEDA). The AGS forms the digital portion of a hybrid 
digital/analog guidance and control system and is configured to provide automatic con- 
trol for mission abort resulting from a primary guidance system (PGS) malfunction. 


The AGS was supplied by the LM prime contractor under NASA cognizance at the 
NASA Lyndon B. Johnson Space Center (JSC) (formerly the Manned Spacecraft Center 
(MSC)). The system resnonsihility of the AGS was subcontracted. The ASA was 


further subcontracted by the subcontractor to the ASA vendor. The software for the 
AEA was contracted by MSC directly to the subcontractor. 


As an aid to the reader, where necessary the original units of smeasure have been 
converted to the equivalent value in the Systeme International d'Unités (SI). The SI 
units are written first, and the original units are written parenthetically thereafter. 


ACRONYMS 
ACE acceptance checkout equipment 
AEA abort electronics assembly 
AGS abort guidance system 
ASA abort sensor assembly 
BPA Bethpage, New York 
C&W caution and warning 
CARR customer acceptance readiness review 
CDH constant differential height 
CDU coupling data unit 
CES control electronics system 
CM command module 
CSI coelliptic sequence initiate 
CSM command and service module 


DEDA data entry and display assembly 


DMCP design mission computer program 


DR design report 

DTO detailed test objective 

DVT design verification test 

EL electrolumine scent 

EMI electromagnetic interference 


EPC 


FACI 


FEB 


FMES 


FRR 


FS 


GSE 


HSSC 


HVSIR 


IA 


ICS 


IFC 


JSC 


KSC 


LM 


LOS 


LSC 


MSC 


MSOB 


OA 


PERT 


PIC 


PGNCS 


PGS 


PTSA 


Earth prelaunch calibration 

first article configuration inspection 
functional electronic block 

full mission engineering simulation 
flight readiness review 

flight simulator 

ground-support equipment 

Hamilton Standard System Center 
H-vector spin input rectification 

input axis 

interpretive computer simulation 
in-flight calibration 

Lyndon B. Johnson Space Center 

John F. Kennedy Space Center 

lunar module 

line of sight 

lunar surface calibration 

Manned Spacecraft Center 

Manned Spacecraft Operations Building 
output axis 

program evaluation reporting technique 
preinstallation calibration 

primary guidance, navigation, and control system 
primary guidance system 


pulse torquing servoamplifier 


RCS reaction control system 


RTV room-temperature vulcanizing 
SA spin axis 
SI Systeme International d'Unités 
TPI terminal phase initiate 
DISCUSSION 


Preliminary LM Abort Concepts 


The preliminary LM abort concepts included definition of early requirements and 
preliminary mechanization. 


Early requirements. - The AGS was developed to provide the capability for safe 
crew abort from the powered descent, lunar surface, and powered ascent phases of the 
lunar mission. During these critical mission phases, information cannot be obtained 
from the command module (CM) or Earth that will ensure crew safety after failure of 
the primary guidance, navigation, and control system (PGNCS). The ground rules that 
defined the preliminary concepts of the AGS hardware are as follows. 


1. Crew safety is primary. This ground rule implies that mission abort will be 
initiated if one additional failure will cause loss of crewmen. On a vehicle having a 
PGS and an AGS, failure of either will result in an abort because one additional guid- 
ance failure will not allow safe rendezvous with the CM. 


2. Abort capability must exist at all times in case of a single PGS failure. The 
capability to initiate an abort must be independent of the LM phasing with the command 
and service module (CSM). The AGS must be capable of coping with initial conditions 
at any instant during powered descent and ascent. The capability of launching from the 
lunar surface at any time must exist. 


3. The AGS must have independent operation. The AGS should be designed to 
operate without dependence on the PGS during critical mission phases. 


4. The AGS should be simple. The system should be able to abort to a clear 
pericynthion of 12 192 meters (40 000 feet) at initial injection or at a later correction 
if no additional hardware is required for the later correction. The CSM, through a 
communication link to the LM, will be used to provide the LM with information for 
performing midcourse corrections. Rendezvous from abort should be completed within 
the LM fuel capacity. 


5. An all-attitude inertial reference should be provided in the AGS. This 
requirement was established to ensure a reference if the three-gimbaled PGS should 
encounter gimbal lock. 


6. The AGS need not be designed to complete the lunar landing mission. This 
rule does not imply that there is not some point in.time when the LM will land with a 
PGS failure. 


7. The AGS should have the capability of using both the ascent and descent stages 
of the LM. This provision was made to use the fuel in the descent stage as well as in 
the ascent stage after an abort. 


Modification of the preceding ground rules was considered to enable the use of a 
simpler attitude reference system, such as a pair of gyros having two degrees of free- 
dom. The requirement for the LM to complete the rendezvous with onboard fuel would 
be modified to have the LM establish itself in a clear pericynthion orbit in the plane of 
the CSM orbit. The requirement for the LM to abort to a clear orbit would be modified 
to put the LM on an intercept path with the CSM. These modifications to the ground 
rules were examined and discarded, primarily because of the increased fuel usage with 
an inaccurate system, the increased burden on CSM activity, and the unsafe trajectories 
involved. 


Preliminary mechanization.- The ground rule requiring LM abort to a clear 
pericynthion orbit and requiring onboard fuel to complete rendezvous made an inertial- 
quality attitude reference system a necessity. A four-gimbaled inertial platform and 
a strapped-down attitude reference were considered. The strapped-down inertial 
reference was selected. The development risks associated with a strapped-down 
system were outweighed by the mechanical simplicity, the inherent ruggedness, the 
ease of maintenance, and the potential of the strapped-down system as a lightweight, 
reliable system for the LM abort mission and for future space applications. At the 
time of evaluation, the weight of the strapped-down sensors (gyros and accelerometers) 
was estimated at 7 kilograms (15 pounds); the associated electronics were estimated 
at 10.9 kilograms (24 pounds). 


An open-loop programer was selected to provide the ascent steering necessary 
for aclear lunar orbit. A programer with an estimated weight of 9 kilograms 
(20 pounds) was the least complex, proven device for accomplishing this function 
because AGS navigation was not required. The programer provided a vehicle pitch 
sequence based ontime of abort and stored constants and produced a thrust cutoff signal 
based on the velocity output of an accelerometer mounted along the vehicle thrust axis. 
A compensation scheme was incorporated into the program to correct for tolerances 
inherent in vehicle propulsion. The compensation scheme compared velocity readings 
from the thrust axis accelerometer taken at specified time intervals with nominal 
velocity values for adjusting pitch attitude and velocity at cutoff. Two accelerometers 
mounted normal to the thrust axis provided attitude biasing in correction of vehicle 
thrust misalinement. (The system outputs were attitude error signals for controlling 
vehicle attitude, total-attitude signals for display, and an engine-off signal.) The 
programer was envisioned as a 2048-word computer having a fixed memory. A control 
panel weighing approximately 4.5 kilograms (10 pounds) completed the preliminary 
mechanization concept. 


Program Redefinition 


The following program redefinition was made concerning AGS requirements and 
mechanization. 


Requirements. - In the fall of 1964, a series of LM program redefinition meetings 
was held biweekly to reconfigure the LM guidance and control systems, including the 
AGS. Several changes were made to the ground rules covering the existing conceptual 
design. 


1. The AGS should be capable of performing rendezvous with the CM within the 
LM fuel budget without information from sources outside the LM. 


2. The AGS should provide information for monitoring the PGS. 


3. The AGS should be capable of providing LM abort to the CSM from any phase 
of the LM mission. 


4. The AGS should be capable of inserting the LM into a clear pericynthion 
orbit of 9144 meters (30 000 feet) above the Moon. This requirement originated 
because the height of some of the lunar mountains was determined to be 8839 meters 
(29 000 feet), although the mountains were not on the lunar equator, the landing site, 
or the lunar-orbit location. This requirement also necessitated clear pericynthion on 
the first abort burn and thus increased the accuracy requirement of the inertial 
reference. 


5. The AGS attitude reference should be maintained at 25 deg/sec angular 
rotation. This requirement was established because of the vehicle rates necessary for 
proper vehicle response to manual commands during the final phase of lunar landing. 


Mechanization. - Revision of the ground rules resulted in discarding the open-loop 
programer concept because of inflexibility and incapability. A general-purpose com- 
puter containing 4096 words was selected to replace the programer. 


Navigation capability was added to the software, and an explicit guidance law was 
selected to perform the rendezvous. A hard-line interface between the rendezvous 
radar and the computer was added for navigation updates. This interface was later 
changed to a manual interface because of a mechanization problem. 


A connection between the PGS digital telemetry downlink and the AGS computer 
was added to obtain state vector initialization information for navigation; this addition 
augmented the existing alinement interface for attitude reference alinement to the PGS. 
A digital telemetry downlink was added from the AEA. Added to the existing total- 
attitude and attitude error displays were computer interfaces for displaying altitude, 
altitude rate, and lateral velocity for monitoring the PGS. 


The AGS therefore became a full guidance system. After alinement from the PGS 
with attitude information and after initialization with LM and CSM position, velocity, 
and epoch time data, the AGS continuously computes LM attitude, LM and CSM position 


and velocity, and abort trajectories for predetermined orbital insertion conditions or 
for orbital transfers to the CSM. The assemblies comprising the AGS are shown in 
figure 1. 


(b) Abort sensor assembly. 


(a) Data entry and display assembly. 


System Description 


The devices comprising the AGS are 
the AEA, the DEDA, and the ASA. 


Abort electronics assembly. - The 
AEA is a general-purpose, high-speed 
digital computer that performs strapped- 
down attitude reference computations and 
navigation and guidance functions required 
to steer the LM to rendezvous. The AEA 
consists of a core memory, control and 
arithmetic logic, input/output circuitry, 
and a power supply. The assembly weighs 
14.8 kilograms (32.7 pounds) and has 
dimensions of 60. 32 by 20 by 13. 33 centi- 
meters (23.75 by 8 by 5.25 inches). The 
AEA (1) processes input information from 
the ASA, the DEDA, and the PGS; (2) per- 
forms attitude reference alinement and state vector initialization; (3) calibrates 
in-flight, lunar surface, and acceieromeier biases; (4) periurms self-tests; (5) imaii- 
tains attitude reference; (6) performs navigation computations; (7) selects mode; 


(c) Abort electronics assembly. 


Figure 1.- Abort guidance system 
components. 


(8) performs guidance computations; (9) outputs steering and engine commands; 
(10) processes telemetry; and (11) displays outputs for in-flight monitoring. 


Half of the 4096 words of memory in the AEA are hardwired and half are 
erasable. Fifty-three escape points exist throughout the wired memory so that cor- 
rections can be made, as required, in softwired memory. The memory uses 
0.0008-meter (30 mil) ferrite cores wired in 64 by 64 planes, one plane for each word 
bit. The word length is 18 bits. Data words consist of a sign and 17 magnitude bits. 
Instructions consist of 18 bits that contain the order code and a single operand address. 


The memory is a coincident current, parallel, random-access core memory with 
a cycle time of 5 microseconds. The functions located in the fixed memory are those 
that require the fastest computation or those that are mission independent (or both 
types); that is, direction cosine and tangent routines. Values that might feasibly vary 
from mission to mission, such as the guidance equations and the radar filter, are 
located in the erasable memory. Computer computations are done in 20-millisecond, 
40-millisecond, and 2-second cycles. The direction cosine matrix is updated 50 times 
per second; the attitude error and engine commands are computed during the 
40-millisecond cycle; and navigation and guidance are computed during the 2-second 
cycle. 


The computer uses a fractional two's complement parallel arithmetic section. 
The computer add time is 10 microseconds; the multiply time, 70 microseconds. The 
AEA executes 27 basic instructions. The clock frequency is 1.024 megahertz. A 
50-word digital telemetry downlink is outputted from the AEA once per second. 


Integrated circuits, thin film networks, and multilayer circuit boards are used 
extensively to minimize size and weight. All subassemblies except the power supply 
are packaged in groups of multilayer boards interconnected by a wiring matrix. Split- 
pin wire wrapping is used to connect the multilayer boards to the matrix. The matrix 
carries all signal lines between the core memory, the arithmetic and control logic, 
and the input/output circuitry. Power is distributed by laminated bus bars encapsu- 
lated in the wiring matrix. The power supply modules are of cordwood construction. 
The sideplates of the AEA are attached to cold rails on which the AEA is mounted in 
the LM aft equipment bay. The AEA dissipates 81 watts of power. 


Data entry and display assembly. - The DEDA is used to control AGS modes of 
operation, to insert data in the AEA manually, and to command the contents of acces- 
sible AEA memory to be displayed on numeric readouts. Manual control is accom- 
plished by depression of pushbuttons on the DEDA panel in the required sequence. The 
DEDA, AEA, and ASA external configurations are shown in figure 1. 


The DEDA consists of two main assemblies: a control panel housing the electro- 
luminescent (EL) numeric display and the data-entry pushbuttons, and a logic enclosure 
housing the drive circuits, the input/output circuits, the power conditioning circuits, 
and the logic circuits. The logic enclosure is a hermetically sealed assembly housing 
nine multilayer circuit boards. The DEDA circuitry is composed of flatpacks and 
thin film networks. The DEDA has access to 452 of the 4096 memory locations in the 
AEA. Manual control is accomplished through the use of 4 pushbuttons for "'clear, " 
"readout, ' "enter, '' and "hold, '' respectively; in addition, 10 pushbuttons for the 
digits 0 to 9 and 2 pushbuttons for arithmetic signs are available. 


The readout consists of an EL nine-window display. Three digits are used to 
display, in octal form, the address of the memory location into which information is 
to be inserted or from which information is to be extracted. Six digits, the first being 
the arithmetic sign, are used to display numeric information. Information transfer 
from the DEDA to the AEA is accomplished by means of a 36-bit serial digital word. 
Display parameters from the AEA are updated twice per second. The DEDA weighs 
3.4 kilograms (7.5 pounds); the dimensions are 14.0 by 15.2 by 13.18 centimeters 
(5.5 by 6.0 by 5.19 inches). The operating power is 10 watts supplied by the AEA. 
The DEDA is mounted without cold rails in the LM cabin. 


Abort sensor assembly. - The ASA is a strapped-down inertial-sensor unit 
mounted to the LM structure and oriented with the coordinate reference axes along the 
vehicle axes. The ASA senses and measures accelerations along and angular rotations 
about the LM axes, converts these motions to discrete increments, and transmits 
these increments in the form of pulses to the AEA for processing. The ASA consists 
of three floated, pulse-rebalanced, single-degree-of-freedom, rate-integrating gyros; 
three pendulous, fluid-damped accelerometers and associated pulse torquing electron- 
ics; a frequency countdown subassembly; coarse and fine temperature controller units; 
a power supply; and interface electronics. 


The ASA uses current pulse torquing to rebalance the output from the sensors. 
Vehicle motions detected by the sensors are converted to alternating-current voltages 
having a magnitude and a phase proportional to the sensed motion. The output of each 
gyro is applied to a pulse torquing servoamplifier (PTSA) that quantizes the signals 
and provides output pulses to the AEA at 64 000 pulses/sec and to the sensor for torque 
rebalancing at 1 kilohertz. 


The gyros used in the ASA were specifically developed for the strapped-down use. 
The accelerometers used are 2401 accelerometers that replaced the Bell VII units 
because of contamination experienced with those units. The sensors and their asso- 
ciated electronics are mounted orthogonally on a beryllium block for temperature con- 
trol. Operating temperature is maintained by single-point control and is provided by 
two devices: a fast warmup control to provide minimum timelag to full operational 
capability and a fine temperature control to maintain the critical operating temperature 
of 322 K (120° F). Two sensors, placed mechanically in diagonal legs of a bridge, are 
used to detect temperature variations. 


Both gyros and accelerometers operate on a torque-balance principle and use 
common pulse torque servoamplifiers. Time-modulated current is used to offset input 
angular rates and accelerations by a forced limit-cycle pulse torquing system. Binary 
torquing using alternate positive- and negative-current periods rather than discrete 
pulses provides a high angular information rate and a low system switching rate. 


Pulses from the pulse torque servoamplifiers to the AEA are quantized at g-18 rad/ 
pulse for the gyros and at 0.000952 m/sec/pulse (0.003125 ft/sec/pulse) for the accel- 
erometers and are supplied at a maximum rate of 64 000 pulses/sec. 


The necessary mounting accuracy of the ASA is obtained mechanically within 
2 arc-minutes through four machined feet mounted to the LM navigation base outside 
and above the LM cabin. A side-mounted coldplate is used in the ASA for heat 
removal. The ASA weighs 9.4 kilograms (20.7 pounds) and has dimensions of 
12.9 by 22.8 by 29. 2 centimeters (5.1 by 9.0 by 11.5 inches). The ASA power dissipa- 
tion is 74 watts. 


The ASA specification values for inertial performance used in the development of 
the ASA are given in table I. (See fig. 2 also.) The ASA specification criteria are aug- 
mented by parameter stability criteria that are exclusively for bench-test maintenance- 
equipment calibrations at one facility. The test limits are given in table II. A 
repeatability limit on the three readings used to determine a mean representing the 
parameter value for any one calibration run is also required for a bench calibration. 
These limits are given in table III. 


TABLE I.- ABORT SENSOR ASSEMBLY SPECIFICATION VALUES 


Trim stability 
Parameter Channel Trim value _——— 


Gyro scale-factor error X, Y, Z| 4500 pulses/min +870 pulses/min 
Gyro bias x 2.4 deg/hr 12.8 deg/hr 
Y 2.4 deg/hr +. 85 deg/hr 
Z 2.4 deg/hr +. 67 deg/hr 
Gyro input axis (IA) mass x, Y, Z 4 deg/hr/g 12.3 deg/hr/g 
unbalance 
Gyro spin axis (SA) mass x, Y, Z 4 deg/hr/g 12.3 deg/hr/g 
unbalance 
Gyro Y-axis alinement x 130 arc-sec 
Accelerometer Y-axis alinement | X 250 arc-sec 
Gyro Z-axis alinement x 250 arc-sec 
Accelerometer Z-axis alinement | X 250 arc-sec 
Gyro X-axis alinement Y 130 arc-sec 
Accelerometer X-axis alinement | Y 130 arc-sec 
Gyro Z-axis alinement Y 250 arc-sec 
Accelerometer Z-axis alinement | Y 250 arc-sec 
Gyro X-axis alinement Zz 130 arc-sec 
Accelerometer X-axis alinement | Z 130 arc-sec 
Gyro Y-axis alinement Zz 130 arc-sec 
Accelerometer Y-axis alinement | Z 250 arc-sec 
Accelerometer scale-factor error| X, Y, Z| 4500 pulses/min +940 pulses/min 
Accelerometer bias discrepancy x, Y 600ng 585ug 
z ++ 113yg 
Accelerometer bias discrepancy x, Y, Z 100ug 


Gyro bias discrepancy 
Input vertical minus 


output vertical -- . 2 deg/hr 
Spin vertical minus 

output vertical -- .2 deg/hr 
Output up minus 

output down - . 33 deg/hr 


Gyro scale-factor nonlinearity 


x 0 to 10 deg/sec | 180 pulses/min 
Y 10 to 22 deg/sec | 200 pulses/min 
z 22 to 25 deg/sec | 580 pulses/min 
x 


Accelerometer scale-factor ,Y, Z 100g 
vonlinearity 
Gyro scale-factor asymmetry X, Y, Z 
Accelerometer scale-factor X, Y, Z 
asymmetry 
a, 
See figure 2. 
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3505), Because of the fixed nature of a 
pulses/min strapped-down guidance system, complete 
calibrations requiring rotation cannot be 


3 


prelaunch calibration (EPC) program used 
in the AEA provides a determination of gyro 
drift when vehicle azimuth and latitude are 
known. In addition to the specification 

% pulses/min requirement, the time-stability values of 
table IV were generated on the basis of the 
AGS estimated capability in flagging non- 

ee ee ee ee es ee a ee characteristic EPC results. 
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Assymetry spread, pulsesimin 


Input rate, deg/sec 


Figure 2.- Abort sensor assembly asym- 
metry requirements. 


TABLE I. - ABORT SENSOR ASSEMBLY TIME-STABILITY LIMITS 


| Shipment 


Limit on delta-mean for delta 
Parameter Channel Symbol Unit time interval, days | From From 
a b 
| Oto 2 | 2to6 | 6to 10 | 10 to 20 | 20 to 40 | 40 to 60 | 60 to 90 90 to 120 eee) ceeee 
G G 
: . 27. -- ae 
Gyro bias X,Y, 2] Boy Byo Bz deg/hr 0.35 0.48 0.54 0.60 0.64 0. 66 0.69 0.73 
Gyro scate factor X, Y, Z s¢ pulses/min| 160 195 240 300 300 300 300 300 -- -- 
(2.62 deg/sec) 
Gyro spin mass unbalance Xx, Y, Z us deg/hr/g - 36 44 . 53 . 66 . 88 1.03 1.19 1.30 -- -- 
Gyro input mass unbalance 
X gyro® x Uy deg/hr/g . 30 35 45 64 .90 1.10 1.35 156] -- - 
-.30 -. 48 -.57 -. 86 -1, 28 -1.63 -2.01 -2.39 -- -- 
Y, Z gyro Y, Z ut 25 35 45 64 .90 1.10 1.35 1.56] -- ae 
Gyro miaalinement? XY, XZ 
YZ, YX My arc-sec 46 46 46 46 46 46 46 46 80 60 
ZX, ZY] 
Accelerometer bias, LA x, Y, Z BA ug ®90 "140 °155 "170 195 215, 240 264 Je de 
Accelerometer scale factor® xX, Y, Z st pulses/min "80 80 ®80 ®80 80 80 80 80 -- -- 
-90 ®.110 © [8-137 | &-192 -280 352 -445 -506 ae sh 
Accelerometer misalinement| XY, XZ 
YZ, YX ay arc-sec 46 46 46 46 46 46 46 46 80 60 
2X, ZY, J 
——__—_i___. 


* HS8C = Hamilton Standard System Center. 
bppa = Bethpage, New York (location of Grumman Aerospace Corporation). 
Applies only after 60 days from sensor acceptance. 

The limit of 46 can be increased to 180 if an output-axis (OA) apparent misalinement problem has been demonstrated to exist. 


smaller than acceptance test limits. 
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performed in a vehicle. However, an Earth 


TABLE II. - ABORT SENSOR ASSEMBLY REPEATABILITY LIMITS 


Limit on Limit on standard 
delta-measurements |deviation o from 
within a set of a set of 

3 calibrations 3 calibrations 


ASA parameter Symbol Unit 


Gyro bias deg/hr 0. 17 
Gyro scale factor pulses/min 66 
(2. 62 deg/sec) 
Gyro IA mass deg/hr/g . 13 
unbalance 
Gyro SA mass deg/hr/g . 18 
unbalance 
Gyro IA arc-sec 495 445 
misalinement 
Accelerometer 42 25 
bias 
We 76 45 
ug 76 45 
Accelerometer pulses/min 22 13 
scale factor 
Accelerometer IA arc-sec 20 12 


misalinement 


a yuo aes ; 
The limit on o for gyro misalinements Y¥xg° ’yx? and Yox% can be increased 


to 106 arc-sec and the limit on delta-measurements to 180 arc-sec for a demonstrated 
OA apparent misalinement problem. 
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TABLE IV. - EARTH PRELAUNCH CALIBRATION TIME-STABILITY LIMITS 


Limits on delta-measurements (or PIC* means) 
for time interval, days 


6 to 10; 10 to 20] 20 to 40] 40 to 60] 60 to 90 
0. 68 0. 78 0.91 1.10 1. 24 1. 39 


Parameter Channel | Symbol 


Zero sway (MSOB?) xX BY deg/hr 
EPC-PIC 
G ,G 
Y, 2 |By, By deg/hr 
G 
EPC-EPC xX By deg/hr 
G G 
Y, 2 |By, B, deg/hr 
Maximum sway (pad) x BY deg/hr 
EPC-PIC 
G ,G 
Y, Z |By, By deg/hr 
G 
EPC-EPC ».4 By deg/hr 
G ,G 
Y, Z |By, By deg/hr 


4DIC = Preinstallation calibration. 
OMSOB = Manned Spacecraft Operations Building. 


Test Program 


The test program for the AGS consisted of design feasibility and verification 
testing, qualification testing, spacecraft testing, full mission engineering simulation 
(FMES), certification test requirements, and acceptance testing. 


Design feasibility and verification tests. - Design feasibility tests were incor- 
porated into the AGS program for component and part selection; for investigation of the 
performance of breadboard models, components, and subassemblies under various 
environmental conditions; for selection of materials; and for substantiation of safety 
margins and other analytical assumptions. The feasibility tests were conducted exclu- 
sively by the assembly vendor in support of design. Design verification tests were 
included in the program to substantiate the correctness of the assembly design for the 
intended mission under simulated ground and flight environments and off-design 
conditions. 


Four assemblies were initially designated as reliability test models and assigned 
to design verification testing. Because the program schedule and cost considerations 
necessitated a reduction in hardware, only two assemblies were assigned to design 
verification testing. The first unit was assigned to critical environments, electromag- 
netic interference (EMI), and overstress testing. Critical environments were to be 
selected by the vendor to ensure that the assembly would pass the design-limit qualifi- 
cation test. During this test, the environments were to be increased from mission 
levels to twice mission levels. The overstress test was to be performed until failure 
and was to use launch or mission environments exclusively. Failure-mode prediction 
analysis was to be used in selecting the overstress environments. The second design 
verification test (DVT) unit was assigned exclusively to mission simulation in the order 
in which the environments were to be experienced. 


Program constraints, primarily schedule problems, resulted in cutting the DVT 
program to one assembly and restricting the tests to design-limit environmental levels. 
Preproduction units were used for design verification testing, although the program 
goal was to use production hardware. The DVT environments for the AGS are given 
in table V. 


In addition to design verification testing, a series of design-proof tests was per- 
formed on the AGS to evaluate interfaces, angular vibration, gyro scale-factor 
asymmetry, EPC (with and without sway), navigation in static and dynamic environ- 
ments, in-flight calibration (IFC), resonance (3 hertz), coning, constants polarity, 
and flight-configuration compatibility (test set compared to flight-configuration 
performance). 
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TABLE V.- DESIGN VERIFICATION TESTING ENVIRONMENTS FOR THE AGS 


Abort electronics 


Environment 
assembly 


Thermal vacuum 
Resonance search 
Temperature vibration 
Shock 

Temperatur e/humidity 
Acceleration 

Leak 

Corrosive contaminants 
Oxygen 

Vibration 


Gyro and accelerometer 
scale-factor linearity 


Gyro and accelerometer 
mechanical frequency 
response 

Angular vibration 

Frequency response 

Saturation and bottoming 


Calibration transients 


Magnetic field 
susceptibility 


Data entry and 
display assembly 


~ ~*~ M~ KX MM MM MK 


Abort sensor 
assembly 


»,¢ 


~ ~*~ Mm KM MM 
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Qualification. - Two production AGS units were assigned to qualification testing. 
The qualification program was originally divided into two phases, qualification and 
postqualification, with a teardown and inspection between the tests. 


The first qualification unit was assigned to simulate the mission environment. 
Ground environment tests were to be performed first, followed by two flight environ- 
ment simulations. The postqualification testing was to consist of two additional flight 
simulations. The second unit was assigned to design-limit testing and unique environ- 
ments, such as salt spray. The postqualification test for this unit was to be two 
overstress tests. 


A ground rule of the test program was that the entire DVT program be completed 
before the beginning of qualification testing. Because of schedule considerations, 
design verification testing and qualification testing overlapped; this rule was modified 
for the AGS so that an environment was tested in design verification testing before the 
same environment was demonstrated in qualification testing. 

Program cost and schedule considerations resulted in the elimination of postquali- 
fication testing. The number of flight simulations was also reduced, and the exposures 
were lengthened accordingly because of the time for setup and teardown of a test and 
the potential damage resulting from the activity. 

In the endurance qualification, a 1000-hour burn-in before starting the environ- 
ment tests was established to simulate the assembly test and checkout period. Because 
of schedule constraints, this period was reduced to 250 hours, and EMI testing was 
performed during the period. 

The AGS qualification history consisted of the following separate tests. 

1. ASA original qualification 

2. ASA accelerometer change qualification 

3. DEDA original qualification 

4. DEDA modified EL display mounting qualification 

5. AEA original qualification 

6. AEA modified internal clock qualification 

7. AEA increased vibration levels qualification 

8. AEA modified memory read/write clock qualification 
The multiple qualification tests were performed because of design changes as noted. 


Qualification testing was monitored by periodic test reviews at the vendor facility during 
the testing. 
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Spacecraft testing. - The subsystem checkout at the prime contractor and at the 
NASA John F. Kennedy Space Center (KSC) was controlled through a test and checkout 
requirements document for each spacecraft. The test criteria for each vehicle were 
supplied to KSC by means of a test and checkout specification and criteria document. 
The KSC response to the MSC test requirements document, outlining the details of the 
tests to be performed, was stated in the test and checkout plan. Operational checkout 
procedures controlled the detailed procedures for each test. 


Full mission engineering simulation. - The prime contractor's FMES was used to 
integrate AGS hardware and software into a closed-loop, six-degree-of-freedom 
simulation with other flight control hardware and software. The ASA was mounted on 
a flight-attitude table, and all hardware functions were used except the accelerometer 
outputs, which were necessarily simulated for input to the AEA. An extensive test 
program was performed on the AGS software baseline, the design mission computer 
program (DMCP), followed by tests of each flight program with hardware. Gyro mass 
unbalance proved to be a significant error source that could not be eliminated in the 
dynamic tests without complex compensations that were not readily available. Before 
activation of the FMES facility, a three-degree-of-freedom test was performed on a 
preproduction unit to verify the stability of the attitude-control loop. 


Certification test requirements. - A series of performance demonstrations was 
set up in the program as constraints on flight. These tests required formal approval 
of the test plans, or certification test requirements, and formal approval of the docu- 
mented test results, or certification test endorsements. The AGS certification 
requirements included qualification testing of the ASA, the AEA, and the DEDA, and 
demonstration of the AGS EPC, in-flight gyro calibration, mission performance for 
the LM-3 Earth-orbit mission, mission performance for the DMCP software program, 
lunar mission performance, and in-flight accelerometer calibration. To avoid redun- 
dant testing, functions normally evaluated as part of vehicle checkout were not 
performed as certification test requirements. 


Acceptance tests. - One major change in acceptance testing was made when the 
vibration levels for each operating assembly were changed from 3g root-mean-square 
random vibration to 6.6g root mean square. The change was made to ensure adequate 
workmanship rather than to reflect the worst mission environment (approximately 3g 
root mean square). The acceptance tests performed on the assemblies are given in 
table VI. Additionally, as a part of acceptance for initial deliveries that were accepted 
as a system, a compatibility test was performed using the three assemblies that com- 
prise the AGS. The tests performed on the AGS consisted of three sets of calibra- 
tions: a lunar aline, an attitude reference exercise, and a connector waveform test. 
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TABLE VI. - ACCEPTANCE TESTS PERFORMED ON THE AGS 


Vibration 


Thermal vacuum 

Detailed operational 

Hardwired memory 

Waveform and power supply regulation 
Operational 

Six-position pushbutton activation 


Low-level vibration and pushbutton 
activation 


Temperature 

Leak* 

Luminescence and pushbutton force 
Warmup 

Test connector on/off and calibration 


Gyro scale-factor linearity and 
asymmetry 


Vibration (launch and boost) and 
calibration 


Servomotor frequency response 
Gyro runup and calibration 


Vibration (ascent/descent) and 
calibration 


Pulse moding 


Gyro and accelerometer scale-factor 


linearity and asymmetry and calibration 


Angular vibration 


Accelerometer pendulum static friction 
test and calibration 


Gyro scale-factor linearity and 
asymmetry 


Calibration 


Abort electronics 
assembly 


x ~*~ KH MK OM 


Data entry and 
display assembly 


x 


Abort sensor 
assembly 


».4 


x 


».¢ 


"To detect leaking pushbuttons, this test was performed in a vacuum and expanded from 


1 to § hours, 


Software Development 


Software development included the formulation of basic requirements and devel- 
opment procedures, verification methods, and use of the software. 


Software functional description. - The following basic mission requirements 
governed software development. 


1. Orbital insertion shall be achieved within a pericynthion greater than 
9144 meters (30 000 feet). 


2. Abort to rendezvous from any point in the LM mission shall be accomplished 
within the LM fuel budget. The total ascent differential velocity (delta-V) is 
1946 m/sec (6386 ft/sec), subtracting 7.6 m/sec (25 ft/sec) for docking. 


3. The maximum navigation error incurred during powered descent, hover, and 
powered ascent shall not exceed 762 meters (2500 feet) and 1.2 m/sec (4 ft/sec). 


4. The AGS must bring the LM within a 9.3-kilometer (5 nautical mile) sphere 
of the CSM with a navigation velocity error of less than 9 m/sec (30 ft/sec). 


The fuel constraint proved to be variable because as vehicle weight increased in 
the course of the program, the available delta-V decreased. The delta-V available for 
rendezvous after insertion, the prime consideration, decreased from 155 m/sec 
(509 ft/sec) to 106 m/sec (349 ft/sec) during the program. To satisfy the software 
requirements, the following capabilities were necessary. 

1. Navigation of the LM and CSM vehicles 

2. Initialization of the LM and CSM state vectors 

3. Alinement of the inertial reference to a selected coordinate system 

4. Maintenance of vehicle attitude information with respect to inertial space 

5. Steering of the vehicle 

6. Calibration and compensation of gyro and accelerometer parameters 

7. Solution of the guidance equation 

8. Generation of monitoring data for displays and telemetry 

9. Automatic in-flight check of computer memory and logic 
To satisfy these requirements, the functions of navigation, alinement, calibration, 


radar data processing, guidance routines, and attitude and engine control were 
implemented. 
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Navigation is performed in the AGS inertial reference frame with the origin at 
the center of the attracting body. Sensed velocity increments from the ASA are trans- 
formed from body to inertial coordinates and used in the navigation computations when 
a threshold is exceeded. The threshold prevents the integration of accelerometer bias 
during coasting flight. The velocity changes caused by gravity are computed, assuming 
a spherical gravity model for the attracting body. State vector initialization information 
on the LM and the CSM is obtained from a hardwire interface with the PGS telemetry 
downlink. If the PGNCS is not operational, the data are inputted through the DEDA. 
The absolute time of the AGS is initialized through the DEDA. A time bias exists 
between the AGS and the mission time because of AGS time-register limitations. Ini- 
tially, LM time was to be based on manning in lunar orbit; a change to mission time 
initialized at Earth lift-off required a fixed AGS time bias. The time bias is kept in 
the PGS, and epoch time for AGS initialization has this bias subtracted before being 
placed on the primary guidance downlink. 


Alinement consists of updating the AEA direction cosine matrix by one of three 
methods provided. The normal alinement frame is the landing site local vertical. The 
X-axis passes through the landing site to the center of the Moon, the Z-axis is defined 
by the vector product of the X-axis and the CSM angular momentum vector, and the 
Y-axis completes the orthogonal triad. The PGNCS provides continuous attitude infor - 
mation to integrator registers in the AEA by means of hardwired connections from 
coupling data units for the three primary system gimbal angles. Although the AGS 
maintains continuous knowledge of the primary guidance alinement, the AEA direction 
cosine matrix is updated with the information only on DEDA command. A second 
alinement capability is that of lunar aline, in which ASA accelerometers are used to 
determine local vertical with respect to vehicle coordinates on the lunar surface. 
Azimuth information is supplied from a quantity stored at touchdown or from a DEDA 
input. An azimuth correction factor can be inputted to correct for lunar rotation during 
the stay time or to correct for a CSM plane change. The third alinement mode is body- 
axis aline in which the direction cosine matrix is set to the body reference frame. 


Three calibration options are available in the AGS software. The gyro and 
accelerometer calibration option is designed for orbital operations. The gyros are 
calibrated to the PGS over a 5-minute period, and the accelerometer readings in free 
fall are compensated during a 30-second period. During in-flight calibration, jet 
firings are inhibited for accelerometer calibration, and vehicle rates are held below 
0.075 deg/ sec for gyro calibration. The second calibration option is lunar surface 
gyro calibration, which requires 5 minutes. The program initially stores the existing 
direction cosine matrix as a reference for computing drift compensation. The input 
angular increment is corrected for lunar rotation rate. In the third option, the accel- 
erometers are calibrated only in free fall during a 30-second period. 


Radar data are inputted through the DEDA to reduce the error in the LM state 
with respect to the CSM. The radar data inputted through the DEDA are range and 
range rate after nulling the radar pointing error with respect to the Z-axis and storing 
the direction cosine. A minimum of six range/range-rate updates at intervals of 
4 minutes is required for an accurate update. For ranges as long as 741 kilometers 
(400 nautical miles), nine updates are required. 
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The five guidance options available are as follows. 


1. The orbital insertion option provides steering and engine cutoff for inserting 
the LM into a desired lunar orbit. 


2. The concentric sequence initiate option computes the horizontal burn required 
to satisfy targeting conditions, the desired terminal phase initiate (TPI) time, and the 
TPI line of sight to the CSM for a final orbit transfer to the CSM. 


3. The constant differential height (CDH) routine computes the burn direction and 
magnitude required to make the LM and CSM orbits coelliptical at a predicted CDH 
time. 


4. The TPI routine calculates the transfer burn for placing the LM on a direct 
intercept trajectory with the CSM based on a fixed transfer time. 


5. The external delta-V routine accepts components of a velocity-to-be-gained 
Ve vector input through the DEDA. The vehicle is pointed along the vector and main- 


tained in a local-horizontal system in real time. 


Attitude errors are generated by the AFA in accordance with selected control 
modes. During attitude reference alinement and calibration, the errors are set to 
zero. In the attitude-hold mode, the attitude errors cause the vehicle to remain at the 
attitude existing when the mode was entered. In the guidance mode, the attitude errors 
cause the vehicle to steer in accordance with the guidance equations. In the acquisi- 
tion mode, the attitude errors cause the vehicle Z-axis to point toward the CSM to 
facilitate radar acquisition. 


An engine-on command from the AGS is issued only after a set of constraints has 
been satisfied; abort or abort stage is commanded, a preset duration of ullage is 
sensed, the automatic discrete is present, guidance control is set to AGS, and guidance 
steering is selected through the DEDA. During powered descent, the ullage constraint 
is removed by DEDA command so that, near the lunar surface, ignition of an engine 
may be instantaneous in the event of a flameout. 


Displays of total attitude, attitude errors, altitude, altitude rate, and lateral 
velocity are computed and outputted from the AEA for crew monitoring. The AGS 
outputs a digital telemetry list of 50 words each second for the monitoring of AGS 
status and performance. 


A ground-support-equipment (GSE) service routine for loading the AEA memory, 
a DEDA processing routine for AEA/DEDA communications, and an in-flight self-test 
routine for checking the AEA memory and logic comprise the major software functions. 


Software development, verification, and use.- The software developed for the 
AGS was obtained by MSC through a direct contract with the subcontractor. Integration 
with the hardware program was obtained by using an AGS performance and interface 
specification for software development maintained by the prime contractor and by 
requesting that the subcontractor hardware program manager he annninted task 
manager for AGS software development. 
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A deliverable program, including mission constants and ASA hardware compensa- 
tion constants, was established for each flight for the softwired 2048 words of the AGS 
memory. The individual flight programs were amended versions of a DMCP delivered 
in March 1967. This program, although nonflight, was used in the contractor's six- 
degree -of-freedom simulation facility to verify AGS performance of the reference 
mission and to satisfy the AGS system responsibility of the contractor. 


The planned software development at program initiation was based on a series of 
five design reports spaced over 11 months from the software vendor in response to and 
interleaved with three data packages from MSC to the vendor. The five design reports 
consisted of the following documents: Design Report (DR) 1 - Preliminary Analysis 
Report; DR 2 - Program Specification and Equation Test Plan; DR 3 - Equation Simu- 
lation Results Summary, Equations Document, Operating Procedures, Program 
Checkout Plan, and Performance Analysis Report; DR 4 - Program Checkout Results 
Summary and Program Verification Test Plan; and DR 5 - Program Verification Test 
Results Summary, Programed Equations Document, Performance Analysis Review 
Report, Program Listing, Binary and Symbolic Card Decks, and Program Tape. 


The three MSC data packages contained special mission requirements and the 
refined mission trajectory consisting of the mission preliminary reference trajectory, 
the reference trajectory, and the operational trajectory. The AGS software perform- 
ance and interface specification contained all other information required for software 
development. 


Because the number of design reports proved unwieldy and excessively time 
consuming, five reports were combined into three. The development schedule was then 
revised, as follows, in terms of time before launch. 


1. At 12.5 months before launch, MSC data package 1, containing the preliminary 
reference trajectory and the mission requirements, is delivered to the subcontractor. 


2. At11 months before launch, subcontractor DR 1, containing the program 
specification and the preliminary AGS mission performance analysis, is delivered to 
MSC. 


3. At 10.5 months before launch, MSC performs a critical design review of 
DR 1. 


4. At 8 months before launch, MSC data package 3, containing the mission 
reference trajectory, is delivered to the subcontractor. 


5. At 7 months before launch, subcontractor DR 2, including the equation test 
results, a verification test plan, and a preliminary program, is delivered to MSC. 


6. At 6.5 months before launch, MSC performs the first article configuration 
inspection (FACI) of DR 2. 


7. At5 months before launch, subcontractor DR 3, consisting of a verified 
flight program and related documentation, is delivered to MSC. 
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8. At 4.5 months before launch, MSC performs a customer acceptance readi- 
ness review (CARR) of DR 3. 


9. At 3 months before launch, MSC data package 3, containing the operational 
flight trajectory, is delivered to the subcontractor. 


10. At 2 months before launch, the subcontractor performs the final performance 
analysis based on data package 3, and MSC performs the flight readiness review (FRR). 


11. At 1.5 months before launch, the subcontractor delivers the final program 
constants tape for computer loading. 


After delivery of the baseline program, the development procedure for the 
balance of the flight programs was shortened to begin at 9 months before launch and 
simplified as follows. 


1. At 9 months before launch, the MSC data package, containing mission 
requirements and the reference trajectory, is delivered to the subcontractor. 


2. At 8 months before launch, the subcontractor interim design report, con- 
taining the program status, the verification test plan, and the performance analysis test 
plan, is delivered to MSC. 


3. At 7.5 months before launch, MSC performs the FACI review of the interim 
design report. 


4. At 6 months before launch, the subcontractor delivers preliminary flow- 
chart changes, operating procedures changes, and a final computer program specifica- 
tion. The unverified program is deliverable at this time for incorporation in the prime 
contractor FMES and the MSC hybrid simulation. 


5. At 5 months before launch, the subcontractor delivers the program, including 
verification test results, performance analysis results, the programed equations docu- 
ment, the operating manual, and a design report. The program is delivered in the 
form of a binary deck and listing, a bench-test equipment loading tape, and an accept- 
ance checkout equipment (ACE) tape for vehicle use. 


6. At 4.5 months before launch, MSC performs a CARR of the prugram delivery 
package. 


7. At 8 weeks before launch, the MSC operational trajectory, mission data, 
and constants are supplied to the subcontractor. 


8. At 5 weeks before launch, the subcontractor delivers the final flight program 
with updated constants in ACE format and the final performance analysis. An FRR is 
performed at MSC. Before subcontractor submittal of documentation, an internal 
subcontractor software review board approves the release. 
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The performance analysis performed for program delivery 5 months before 
launch consisted of Monte Carlo runs using the ASA specification error model and the 
ASA capability estimate error model in mission simulations. The mission simulation 
cases Selected were the most stringent and always included abort from hover. The 
performance analysis performed 5 weeks before launch used an error model generated 
from data taken on the flight model ASA. 


Verification of proper computer loading was accomplished in the following 
manner. The flight program card deck delivered at the CARR was transposed by the 
prime contractor to an ACE tape or the format used to load the AEA by the ACE com- 
puter at KSC. The prime contractor ACE tape was transmitted to the subcontractor for 
independent verification and then sent to KSC. The final AEA dump, after loading with 
the constants-updated program in ACE format (supplied by the subcontractor 5 weeks 
before launch), was compared with the prime-contractor-generated ACE tape, and the 
noncomparing memory locations (noncompares) were printed out. The noncompares, 
which represent the updated mission constants, were compared with a list of expected 
noncomparing locations supplied by the subcontractor at the time of the FRR. An 
additional verification procedure for comparing the original subcontractor binary card 
deck with the final memory dump was also followed for the first flight but was discarded 
for later flights because of redundancy. 


The verification procedures used in the course of program development by the 
subcontractor consisted of equation testing, program checkout, verification testing, 
and performance analysis. Scientific or engineering simulations of the equations ina 
closed-loop configuration were designed to demonstrate equation performance under 
both nominal conditions and vehicle, sensor, or trajectory dispersions of 3 standard 
deviations (3c). Testing of the coded program was performed by using a bit-by-bit 
interpretive computer simulation (ICS). This check verified that the program was 
implemented in accordance with the equations. 


A closed-loop interpretive simulation of the AEA program and the vehicle flight 
characteristics (ICS flight simulator (FS)) was used in verification testing. Verification 
that the program was capable of guiding and controlling the vehicle in all operating 
modes was accomplished. Special ICS driver routines also were formulated to augment 
this test. A Monte Carlo analysis program using 600 cycles was performed to deter- 
mine detailed AGS performance compared to mission requirements. 


Verification also was performed at MSC by using a hybrid computer facility with 
actual ASA and DEDA hardware for independent test cases and by using special test 
cases in the subcontractor ICS/FS program. Additional testing for each mission was 
performed by the prime contractor with a six-degree-of-freedom computer simulation 
incorporating the AGS as well as other hardware components in the LM flight control 
system. 


The selection of hardware compensation constants for the final program tape was 
made after examination of the data history of the actual flight ASA. In all cases, the 
examination resulted in the selection of the final bench calibration values with the 
exception of the accelerometer scale factor, which was extrapolated to the time of the 
mission. The predictable effects of magnet aging on the accelerometer scale factor 
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enabled this extrapolation. The gyro values were checked by Earth prelaunch calibra- 
tions performed after final ASA installation in the vehicle. The EPC uncertainty of 

0. 37 deg/hr and the stability exhibited by the ASA‘led to maintaining the compensation 
values at those obtained by the more accurate bench calibration. In-flight calibration 
of gyro and accelerometer biases before undocking in lunar orbit allowed final compen- 
sations for the mission. 


Other software deliverables supplied to MSC were EPC tapes and simulated flight 
procedures. Earth prelaunch calibration was a 20-minute special program for deter- 
mination of gyro drift in the vehicle sway environment. The other ASA parameters 
used in the EPC tape for compensation were derived from data taken during the first 
ASA bench calibration at KSC. 


The simulated flight program consisted of a set of procedures used with a speci- 
fied flight program to simulate various mission phases. The purpose of the simulated 
flight was to gain confidence in AGS operation with interfacing LM subsystems. Simu- 
lated flight procedures of the AGS were designed to test AGS simulated flight initializa- 
tion; CSM acquisition; radar filter; abort from powered descent; abort from the lunar 
surface; and coelliptic sequence initiate (CSI), CDH, TPI, and external delta-V guidance 
solutions. The criteria for the tests were obtained from interpretive computer simula- 
tions and resulted in value bounds or bounded curves for various AEA and display 
parameters. Simulated flights were performed throughout AGS testing as an integral 
part of operational checkout. 


Software changes were accomplished through the submittal of software change 
proposals generated independently or on request by the software vendor. A formal 
MSC board, controlling both AGS and PGNCS software, reviewed the software change 
proposals. 


Abort Guidance System Mission Revisions 


Revisions to the AGS mission are discussed in the following paragraphs. The 
major change consisted of replacement of the direct-ascent trajectory for rendezvous 
with the coelliptic flight plan. 


Direct ascent. - The first AGS rendezvous concept was a minimum-time, direct- 
ascent trajectory to the CSM following abort. The CSM orbital altitude for this mission 
was 148 kilometers (80 nautical miles). For CSM phase angles that precluded direct 
ascent, the AGS was placed in a parking orbit at the insertion altitude and then at 
15 240 meters (50 000 feet) to obtain the maximum catchup rate to the CSM. Data for 
orbital transfer to the CSM were obtained from external sources. 


Coelliptic flight plan. - In January 1966, the direct-ascent concept was discarded 
and replaced by the coelliptic flight plan, which essentially provided for an LM parking 
orbit for all ascent cases. The CSM orbital altitude was changed to 111 kilometers 
(60 nautical miles) for this procedure. A diagram of the coelliptic sequence is given 
in figure 3. 
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Figure 3.- Coelliptic rendezvous flight 
profile. 


The AGS, following abort or ascent 
from the lunar surface, inserts the LM into 
a lunar orbit based on insertion altitude, 
insertion altitude rate, and desired lunar 
orbit, usually 17 by 56 kilometers (9 by 
30 nautical miles), under automatic control. 
The LM coasts until the time of ignition of 


the first burn ie A? which places the LM 


approximately 90° from the insertion point. 
At that time, the rendezvous profile is ini- 
tiated with the CSI maneuver. The burn is 
normally done in the external delta-V mode 
using the reaction control system (RCS), as 
are all burns of the rendezvous sequence. 
The CSI burn magnitude is determined by an 
iterative technique such that a desired rela- 


tionship between the CSM and the LM exists at a specified time (time of ignition of the 


third burn t. 


ec? following a maneuver to produce a CDH between the CSM and the LM. 


The CDH burn following CSI is performed at the predicted time of LM orbit apofocus 


(or perifocus). 


Because of this burn, the LM orbit becomes coelliptic with that of the 


CSM, the line of apsides of the two orbits is alined, and a constant differential altitude 


between the two vehicles exists. 


The final planned burn of the sequence, TPI, is per- 


formed at the point at which a desired line-of-sight angle (usually 26.6°) between the 
LM and the CSM is reached. The magnitude is based on a fixed transfer time to ren- 
dezvous, usually equivalent to a 130° central angle transfer. The parameters of the 
transfer trajectory are determined by iteration to bring the LM to the predicted position 


of the CSM at the specified time. 


Two midcourse maneuvers are performed, as 


required, after TPI, and the burns are computed by the same technique used for the 


TPI maneuver. 
meters (5 nautical miles). 


The braking maneuver for docking is originated at a range of 9.3 kilo- 
A range and range-rate chart profile is followed, inter- 


leaved with nulling of the line-of-sight rate. 


The sequence of events following an abort depends extensively on the time of 


abort. 


The nominal sequence outlined is used for aborts near the lunar surface. 


For 


aborts before powered descent, the TPI maneuver may be performed initially. The 
nominal sequence is also subject to extensive changes in the course of mission planning. 
A fixed or canned external delta-V maneuver can be performed before CSI; a dual CSI 
burn may be performed before CDH; and phasing maneuvers may be incorporated as 
requirements for landing site selection, rendezvous lighting, and rendezvous location 


dictate. 


Mission Operation 


The AGS is maintained operational in a ready state throughout the lunar mission 
as a backup to the PGS. A nominal operational profile is described in this section. 
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Lunar orbit.- The AGS is inoperative during the translunar-coast phase, and the 
ASA heaters maintain the ASA at a temperature of 322 K (120° F). Coolant is not sup- 
plied to the ASA coldplate. After the crewmen enter the LM in lunar orbit, the system 
is activated and the gyros are tested for a minimum of 25 minutes. An AEA self-test 
consisting of an AEA memory sum check and logic test is performed by DEDA com- 
mand. The DEDA operation and the EL segment operation are verified. The AEA 
time is initialized by a DEDA entry, and an LM and CSM state vector initialization 
from the PGS downlink is performed. The AGS is then alined to the PGS, and the 
results are checked by monitoring the total-attitude indicators and the system digital 
downlink. The initialization of the AGS is checked by calling up the range and the 
range rate to the CSM and the in-plane angle between the Z-body axis and the local 
horizontal on the DEDA and by comparing the PGS readings. In-flight calibration of 
the AGS gyros and accelerometers is then performed. 


Powered descent. - The gyro drift and navigation errors of the AGS are mitigated 
for the descent phase by a state vector initialization from the primary system 10 min- 
utes before powered descent and by analinement to the primary system 5 minutes 
before powered descent. During powered descent, the AGS is in the followup attitude 
reference mode because the primary system is in the vehicle-control mode. The AGS 
independently maintains an attitude reference, navigates, and solves the abort problem. 
The attitude, altitude, and altitude rates of the AGS are compared with those of the 
primary system during descent. The LM inertial velocity is displayed on the DEDA. 


At an altitude of 1829 meters (6000 feet), the AGS navigation errors are further 
reduced by a DEDA altitude update. An AGS abort may be accomplished at any time by 
switching guidance control to AGS and pressing the abort button. 


Lunar surface. - After touchdown, the AGS lunar surface azimuth is stored. Fol- 
lowing a decision to stay, the LM state vector is initialized using information stored in 
the AEA before descent that reflects the lunar surface state, and the AGS is placed in 
lunar aline. When all systems are verified as operational, the AGS is initialized and 
alined to the primary system, the lunar azimuth is again stored, and an AGS lunar 
surface gyro calibration is performed. The AGS is then placed in standby with only 
the ASA operational for the duration of the stay on the lunar surface. 


Before ascent, AGS time, state vectors, and alinement are again initialized, and 
a lunar surface gyro calibration is performed. The AGS is placed in lunar aline 
approximately 30 minutes before lift-off and is changed to guidance steering 2 minutes 
before lift-off to reduce gyro drift effects on the attitude reference. 


Powered ascent. - During ascent, the AGS is in followup and is independently 
navigating and solving the insertion problem. The thrust axis Vo is monitored on the 


DEDA during the latter half of ascent. Initially, AGS total velocity is monitored. 
After insertion cutoff, the AGS velocity residuals in each axis are compared with the 
PGS and trimmed. 


Rendezvous sequence. - After insertion, the AGS is updated in relation to the CSM 


by the insertion of radar range and range-rate information through the DEDA. The 
AGS facilitates rendezvous radar acquisition of the CSM by a mode that points the 
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vehicle Z-axis at the CSM. Nine range and range-rate points are required before the 
first coelliptic sequence maneuver, CSI; six points are required before each subsequent 
powered maneuver. The AGS independently solves for each powered maneuver and 
operates without dependence on the PGS after insertion for rendezvous. 


Abort Sensor Assembly Development Problems 


The following significant problems were encountered during the development of 
the ASA. 


Initial accelerometer selection.- The Bell IIIB accelerometer was originally 
proposed for the AGS and approved. At the time of program initiation, however, strong 
arguments were advanced by the contractor for switching to the Bell VII, a new, 
scaled-down version of the Bell IIIB. Although the Bell IIIB operational and test experi- 
ence was extensive during the Ranger Program and at the NASA Jet Propulsion Labora- 
tory, the arguments for savings of 1.1 kilograms (2.5 pounds) in weight, 0.0005 cubic 
meter (29 cubic inches) in volume, and 4 watts of steady-state power were attractive. 
The deciding argument, however, was that hermetic sealing of the Bell IIIB would be 
expensive in terms of scheduling, requiring 16 weeks for delivery of an unsealed unit 
and 8 months for delivery of a sealed. unit compared to 4 weeks for initial sealed 
Bell VII delivery. A change was made to the Bell VII unit. Subsequent events, how- 
ever, revealed that the hermetic sealing of the Bell VII had not been adequately proved, 
and a redesign of the case was required to prevent ''oil canning.'' Subsequent bias 
stability and contamination problems with the Bell VII have indicated that the original 
selection of the Bell IIIB accelerometer was correct. 


Spin motion rotation detectors. - The necessity for monitoring gyro wheelspeed 
became apparent in the early stages of the program. Platinum cobalt slugs were added 
to the gyro wheels with a pickoff coil to generate a pulse for each wheel revolution. 

The spin motion rotation detectors also served to check wheel runup and rundown times 
and, therefore, bearing integrity. 


Noise. - A general electronic noise problem within the ASA became apparent with 
the integration of the first ASA. Inertial performance changed when the test-connector 
outputs were capped instead of being connected to the test set. No single design 
change eliminated noise problems. Corrective actions taken included eliminating 
ground loops with the test set connected, rerouting sensitive internal leads, twist- 
ing instrument torquer leads instead of using shielded cable, using shields between 
the pulse torque servoamplifiers and the power supply, and connecting secondary power 
ground internally to chassis ground. 


Temperature maintenance. - The ASA instruments were heated through a beryl- 
lium block rather than through individual sensor heaters. The beryllium block repre- 
sented an extensive design task, requiring complex shaping and drilling to achieve 
proper heat transfer and thermal gradients. Nine designs for the beryllium block were 
required to achieve the final design. 
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Internal cabling.- Flexible, multilayer printed circuit cable was used in the 
interconnecting internal harnessing of the first preproduction ASA primarily because 
of the weight and volume limitations of conventional wiring. This method required more 
volume than anticipated, had an unsatisfactory appearance because the cable would not 
stay molded around corners, and was impractical from the standpoint of accommodating 
design changes. Conventional point-to-point stranded wiring in bundles was used in the 
second preproduction ASA. 


Thermal design. - The ASA power supply was located between the main housing 
and the heat sink. The preproduction power supply was potted in a thermal conducting 
compound that allowed heat to permeate through the compound from the main housing 
and the power supply to the heat sink surface. The thermal conductivity of the potting 
compound, however, was not as high as anticipated (0.5 W/m-K (0.3 Btu/hr/ft-°F) 
compared to 36.5 W/m-K (21 Btu/hr/ft-°F)), and a weight penalty was incurred because 
of the dense potting compound. The production power supply was designed such that all 
significant heat-producing components and modules were heat sunk directly to the cold- 
plate side of the power supply housing. A less dense potting compound could then be 
used with considerable weight reduction. Heat from the main housing was routed by 
two studs through the power supply to the coldplate surface. These studs incorporated 
adjustable slugs by which the thermal path between the main housing and coldplate could 
be varied. The capability of trimming total power consumption after ASA assembly 
was gained. 


Mounting feet. - Each pair of preproduction ASA mounting feet was an integral 
unit at each end of the housing. Each foot contained a Mycalex ring that served as a 
thermal barrier, but machining the Mycalex was difficult. Because of continued 
exposure to the specified vibration environment, fatigue failures occurred. An individ- 
ual suspension system was incorporated for the production design. Each foot was 
attached to the block with a thermal path small enough to eliminate the need for 
Mycalex. The body of each titanium foot was hollowed, and an aluminum slug covered 
with an elastomer was inserted to provide damping and to prevent exceeding the speci- 
fication resonance requirements. 


A second change was necessary when high resonances occurred as a result of 
elastomer deterioration caused by extended periods of vibration. Several other materi- 
als were tested for damping efficiency when inserted in the foot in place of the aluminum 
slug andthe elastomer. Although analysis indicated otherwise, a solid titanium foot 
did provide adequate damping and was less difficult to manufacture. Solid titanium was 
incorporated into the foot design. 


Cover support.- The preproduction ASA cover that served as the support member 
for the three connectors was undesirable structurally and time consuming to remove. 
A separate structural member was designed to support the connectors, and the cover 
was redesigned. 


Accelerometer scale-factor temperature sensitivity.- The Bell VII accelerometer 
scale-factor temperature sensitivity was higher than tolerable. Temperature compen- 


sation was incorporated into the accelerometer design, but the accelerometer was later 
discarded because of contamination problems, 
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Thermal runaway.- A potential thermal runaway existed in the ASA design if the 
sensing thermistor controlling the fast warmup opened or if the trim resistor short 
circuited. This condition could endanger other equipment on the LM adjacent to the 
ASA. Anormally closed thermostat set to open at a temperature of 339 K (150° F) 
(322 K (120° F) normal operation) and set to close at 328 K (130° F) was incorporated 
in series with the +12-volt ASA power supply caution-and-warning (C&W) signal. The 
ASA is turned off manually if the display indicates a malfunction on this line. 


Accelerometer warmup. - The Bell VII accelerometer bias had an excessively 
long warmup time. The requirement for +30yg of steady state in 25 minutes was 
violated by several hundred milligals (ug's) for several hours. The long warmup was 
caused by an electrostatic charge buildup between the capacitor plates and the torquer 
coil on the pendulum when the torquer coil potential was 16 volts above ground and by 
a change in the resulting electrostatic forces on the pendulum as the charge leaked off 
gradually. 


The accelerometer torquer is operated at a 16-volt, direct-current potential 
relative to ground because of the PTSA design. This potential causes buildup of an 
electrostatic charge between the pendulum and the capacitor plates that is inversely 
proportional to the relative distance between them. When the pendulum is not physi- 
cally centered, one plate exerts a greater force on the pendulum than the other. 
Because of low leakage rates of the bridge circuit capacitors, much time is required 
to null the electrostatic forces. The long time constant causes the effective bias to 
change proportionately. 


Initially, a capacitor adjustment was made to bring the electrical null around 
which the accelerometer operates into coincidence with the electrostatic null. Bleed 
resistors were later added to drain the electrostatic charge. 


Cover design. - Problems developed in building the single-piece ASA cover. The 
initial procedure was to build the inner skin first, bond honeycomb core material to it, 
and then bond the outer skin to the honeycomb. To facilitate manufacturing, the honey- 
comb core material was changed to polyurethane foam. The foam, however, separated 
at the bond line during extended vibration, and the core material was changed back to 
honeycomb. 


Additionally, during environmental testing, pins from the electronic subassem- 
blies shorted, through tolerance buildup, to the inner aluminum skin of the cover 
through an insulating fiberglass board. The inner aluminum skin of the cover was 
replaced with fiberglass. The thermal and EMI effects of the change were acceptable. 


Thermal-vacuum effects. - Because of thermal-vacuum exposure as high as 
0.7 deg/hr, gyro bias shifts occurred during initial ASA testing. The problem was 
first thought to be thermal because the temperature difference between the gyros and 
the mounting block increased as much as 1.1 K (2° F) under vacuum conditions. The 
gyro mounting holes were enlarged to minimize changes in heat flow across the airgap 
from the gyro case to the mounting block between ambient and vacuum conditions. This 
action did not correct the problem. A thermally conductive compound was then applied 
to the gyro seats to prevent the thermal resistance across the interface from being 
affected by pressure variations. This addition reduced the thermal-vacuum shifts 
below the 0. 3-deg/hr specification. 
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Gyro mass unbalance instability. - Both long- and short-term mass unbalance 
instabilities became evident in the RI-1139B gyro. The long-term shifts violated the 
initial specification requirement of 2 deg/hr/g; thus, the use of mass unbalance became 
an uncertain indicator of bearing wear. The shifts were orientation dependent and pre- 
dictable with orientation change. The cause of the shifts was presumed to be settling of 
the two-cut gyro flotation fluid under gravity conditions. Gyro circle tests were insti- 
tuted during acceptance to determine that the shift magnitude was bounded, and the 
specification was relaxed to a value of 4 deg/hr/g. Because of the fixed sensors, the 
ASA has the advantage that only X-gyro-spin-axis mass unbalance (due to thrusting) is 
a Significant error source in the mission. Corrective action was taken to store both 
the ASA units and the gyros before installation in a fixed orientation to eliminate the 
mass unbalance shifts. The ASA shipping container was modified to mount the ASA 
X-axis vertical, as it is mounted in the vehicle, rather than the previous Z-axis verti- 
cal. The gyros were preassigned a specific ASA axis and stored in the position before 
mass unbalance trim. After acceptance, they were maintained in the chosen position 
until ASA installation. 


The short-term instability was observed during processing by the gyro manufac- 
turer and the ASA vendor. Because of the different torquing methods used at the two 
installations, the shift was found. Analog torquing used by the manufacturer dissipated 
0.7 watt. Pulse torquing used by the vendor put 1.3 watts in the torquer. The manu- 
facturer corrected this discrepancy by performing the final mass unbalance adjustment 
with 1.3 watts dissipated in the torquer. 


Gyro fluid contamination. - Erratic gyro drift was evident in the first units pro- 
duced by the manufacturer. Particle contamination was found in three units. Extensive 
changes were made in quality control procedures, and improvements were made in the 
manufacturer's cleanroom facility. Fluid control was tightened, wax seals were 
eliminated from the fill system, a molecular seine was added, and a back pressure fill 
system was used. 


Accelerometer bias instability. - Accelerometer bias shifts of several hundred 
milligals (ug's) were observed at the inception of the Bell VII program. Investigation 
of these shifts revealed that they were asymptotic and storage and temperature depend- 
ent and that a maximum shift of 900ug was possible over a 5-day period when stored 
with the input-axis up and then down and with the temperature maintained at 339 K 
(150° F). Reducing the storage temperature to 322 K (120° F), the ASA operating 
temperature, reduced the shift to 300ug peak to peak. The fixed ASA storage, adopted 
because of gyro mass unbalance shifts, also mitigated the problem. The shift was 
traced to the creep rate of the epoxy joint between the aluminum structure and the pen- 
dulum copper beryllium spring. The ASA shipping containers were modified to reduce 
the storage temperature from 339 K (150° F) to 322 K (120° F). The IFC of accelerom- 
eter bias, previously incorporated in the AGS software, contributed to eliminating the 
effects of the instability during the mission. 


Accelerometer contamination. - A significant ASA problem developed because of 
contamination within the Bell VII accelerometer. The failure mode was the adhering 
of the accelerometer pendulum to one of the capacitive pickoff plates while in the off 
mode such that the 3¢ restoring force of the loop would not free it upon activation. The 


failures occurred on units that had been in the field for approximatelv 1 vear. The 
PR J v 
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pendulums on two field units were definitely captured, and a third exhibited a tendency 
to stick. During analysis of the contaminant, two primary substances were noticed on 
the brass capacitive pickoff plates. One substance was a viscous film composed of 
amines from a catalyst used in curing the encapsulant for a transformer within the 
accelerometer. The second was a whitish growth composed principally of zinc chloride. 
Tests indicated that the contaminant could be grown on brass in the presence of contam- 
inant sources. Dezincification of the brass would occur in the presence of chlorine and 
moisture, 


A pendulum freedom test, open loop, was performed to screen the accelerometer. 
The test criterion was that the pendulum fall free from a capacitive pickoff plate within 
6° of vertical. Of the 26 units tested, 15 exhibited a degree of stickiness. An outgas- 
sing procedure was incorporated to eliminate the contaminant. All seven units commit- 
ted exhibited stickiness after a temperature cycle following reassembly. The theory 
was that moisture entered the units because the accelerometers were not sealed during 
this cycle. 


To provide a "'superclean" accelerometer, more comprehensive processing 
changes were instituted as follows. 


1. All components were outgassed at less than 100 micrometers. 


2. Temperature cycling and magnet stabilization were performed in dry 
nitrogen. 


3. Use of chlorothene cleaner was eliminated. 

4. Use of tapwater (chlorine) was eliminated. 

5. Silicone grease was eliminated from all vacuum processing. 

6. Flux was eliminated. 

7. The brass capacitor ring surface was cleaned with a glass brush. 

8. All tape used in final assembly was outgassed or eliminated. 

9. Each unit was vacuum outbaked 4 hours before final seal and backfill. 


10. Each unit was filled with 75 percent dry helium and 25 percent dry nitrogen 
instead of 25 percent air. 


11. All parts were stored in dry nitrogen. 
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Recycling the units through the outlined procedure did not remove the contaminant, 
and a pendulum remained stuck on one unit. At this point, the following options were 
considered. 


1. To embed jewels in the capacitive pickoff ring to reduce the area touching the 
pendulum 


2. To recycle the accelerometers through an even more stringent cleaning 
procedure 


3. To compartmentalize the accelerometers and, thereby, to separate the elec- 
trical components from the mechanical parts 


4. To change the brass pickoff plates to titanium despite the difficulty in machin- 
ing titanium 


5. To change the accelerometer 


Based on favorable results of an investigation of the 2401 accelerometer for ASA usage, 
a decision was made to change accelerometers. 


Gyro scale-factor asymmetry. - An error source not initially under specification 
control produced a significant dynamic drift rate in a rotational vibration environment. 
The error source was gyro scale-factor asymmetry, the difference in gyro scale-factor 
error between a positive and a negative input rate. Although gyro scale-factor non- 
linearity error was specified at 180 pulses/min to limit the asymmetry to 360 pulses/ 
min, the drift rate d produced for a fixed, square-wave rate of 1 deg/sec is 


d = 360x 1076 x 1x 0.5 x 3600 = 0.65 deg/hr. Results of mission error analysis 
revealed that, for all input rates, a value of 200 pulses/min or less was required in 
the Y-axis and a value of 360 pulses/min or less was required in the X-axis and the 
Z-axis. Examination of a wide range of input rates, in addition to the 3 deg/sec in 
which scale-factor nonlinearity is normally measured, revealed the scale-factor 
asymmetry to be as large as 500 pulses/min. Two ASA units were determined to be 
unacceptable for flight because of large asymmetry readings. 


The effect of noise on the current pulse used to torque the gyro caused the asym- 
metry. The noise originated from two sources. Synchronous noise spikes of 8 kilo- 
hertz riding on the current pulse affected the area under the current pulse as it 
shortened and lengthened, and deformation was also found on the trailing edge of the 
64 000-pulse/sec output, which determines switching of the gyro torquer current. In 
the corrective design changes, the synchronous 8-kilohertz value was changed to 
asynchronous 8. 25 kilohertz to allow the noise effects to be averaged and to derive a 
stable 64 kilohertz separately from the frequency countdown module. A specification 
of 120 pulses/min at all input rates was placed on gyro scale-factor asymmetry; 
however, this requirement was violated at low rates after the modifications in several 
cases, and a curve defining allowable asymmetry as a function of input rate was 
specified. 
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Gyro resonance. ~- As a result of skewed-axis vibration tests on ASA units in the 
3-hertz range, a determination was made that significant drift rates could be induced 
for sinusoidal inputs. The error source was the H-vector spin input rectification 
(HVSIR). In an unperturbed condition, the gyro wheel rotates in synchronism with the 
stator field. If a low frequency sinusoidal angular rate is applied about the spin axis, 
the wheel will remain in synchronism with the stator field. If the sinusoidal rate is 
increased, however, the magnetic effect will not be strong enough to drive the wheel in 
synchronism with the stator field, and the wheel will not follow the sinusoidal stator 
motion. Between synchronism and asynchronism, the wheel is excited at a resonant 
frequency. Small angular rates at this frequency (3 hertz) about the spin axis can cause 
large deviations in instantaneous wheelspeed and result in gyro angular momentum. If 
sinusoidal inputs of the same frequency and phasing are applied simultaneously about 
the input and spin axes, a positive spin-axis rate will cause the angular momentum to 
increase momentarily for positive rates applied about the input axis and to decrease 
momentarily for negative rates. Float precession is greater for positive inputs, and 
a positive drift rate results. 


For the HVSIR error to become significant, the frequencies applied to the spin 
and input axes must be the same, be in phase, and be at the frequency of gyro 
resonance. Analyses and simulations proved that the LM vehicle limit cycling did not 
approach this condition, and no corrective action was necessary. 


Accelerometer vibration limitations. - The Bell VII accelerometer had restrictive 
vibration limitations because of the physical construction and the low electrical damping 
of the loop. The accelerometer is filled with a gas; this condition provides negligible 
pendulum damping. The accelerometer loop was designed to accommodate accelera- 
tions of 3g for an expected mission thrust environment of less than one g._ Linear 
random vibration ranging from 1.0g to 1. 2g root mean square, derived from the 


LM oe” /nertz environment with a peak at 60 hertz, caused the pendulum to hit the me- 
chanical stops and resulted in unacceptable loss of input information. 


Extensive vehicle tests using line RCS firings determined the vehicle environment 
to be 0.7g root mean square, and the ASA was qualified at 0.9g root mean square, a 
very low level. Rescaling the accelerometer to 15g was studied, but replacement of 
the Bell VI accelerometer with the fluid-damped 2401 accelerometer removed concern 
for the ASA vibration environment. 


Gyro output-axis rotation effect.- During bench calibration, a large misalinement 
shift, although less than the specification of 130 arc-seconds, was found on several 
units. After an investigation, the cause of the apparent misalinement was attributed to 
an instability in the gyro output when rotated about the output axis (OA). Analysis and 
testing proved that the effect was not significant in mission performance and was not a 
failure precursor. The cause of the phenomenon was postulated as friction between 
the OA pivot and the jewel. When a gyro is rotated about the OA, gyroscopic action 
causes the float to precess about the input axis until the OA pivot contacts the jewel. 
When the pivot and the jewel are touching, the resultant friction will cause a torque to 
be exerted on the OA shaft. The torque appears to be directly proportional to the OA 
rate. Reversal of the OA rotation will move the pivot off the jewel wall and will cause 
contact with the jewel on the other side. The error source is rectification of OA angu- 
lar motion through unequal friction effects on opposite sides of the jewel. 
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Fast warmup oscillation. - During vehicle testing at KSC, vehicle alarms were 
triggered when the ASA fast warmup circuitry was in operation. The problem was due 
to a noise of 13 megahertz that was placed on the vehicle 28-volt line by the ASA. A 
0.1-microfarad capacitor was added to the fast-warmup-unit output to eliminate the 


oscillations that were traced to the characteristics of a transistor in the heater 
circuitry. 


Coldplate connection. - Helacoil inserts having a locking feature are used in the 
ASA for attachment of the coldplate. Repeated mounting and dismounting caused many 
fractures in the insert and necessitated replacement. To correct this problem, short 
screws that did not engage the locking mechanism were used during vehicle testing. 
Full length screws were used for the final mounting of the ASA at KSC. 


Gyro flexible lead. - A flexible lead failure on a nonflight gyro was attributed to 
weakening of the lead due to the formation of silver bromide corrosion on the lead and 
to a nick in the lead caused by faulty workmanship. Test results revealed that 
bromine from the flotation fluid, polybromotrifluoroethylene, came out of solution to 
combine with silver lead only above 393 K (248° F). Because the ASA operates at 
322 K (120° F) and the gyro was maintained in an uncontrolled environment, the failure 
was attributed to poor workmanship and overheating. No evidence of silver bromide 
was found in dismantling other units. 


Abort Electronics Assembly Development Problems 


The following significant problems were encountered during the development of 
the AEA. 


Memory cycle time. - A 4-microsecond memory cycle time was the design goal 
originally set in the AEA program. This time was changed to 5 microseconds after 
the design was proved incapable of accommodating the faster cycle time. 


Memory structure. - A mémory failure occurred during qualification testing 
because of drive lines opening in the core stack. The problem was a structural failure 
in a hat bracket supporting one of the memory endboards. The bracket was strength- 
ened, and the unit subsequently passed qualification tests. 


Sideplate screws. - Vibration caused loosening of several screws inside and 
outside the AEA. Manufacturing procedures were changed to torque all screws ina 
specified sequence to a designated level (68 + 5.6 joules (6 + 0.5 inch-pounds)). The 
addition of a sealing compound to the external screwheads was also necessary, although 
use of the compound was undesirable because of potential contamination. 


Clock. - An external clock was used in the programer concept for the AGS, and 
this concept was carried over to the AEA to minimize vehicle EMI and synchronization 
problems. The AEA used a frequency of 1.024 megahertz from the vehicle instrumen- 
tation master clock. The PGS clock provides a synchronization clock output to the 
instrumentation clock. Results of testing revealed that activation of the primary 
system produced initial noise transients through instrumentation that affected the AEA 
Inemoury. After evaluating and rejecting the nossibility of adding a one-shot multivi- 
brator to the AEA clock input, a free-running (18-pulse/min stability), independent 
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crystal oscillator was installed in the AEA to correct the problem. Problems were 
encountered in crystal procurement in that frequency shifts down to one-third the funda- 
mental frequency of 1.024 megahertz were observed. These shifts were caused by 
lower resistance at some harmonics than at the fundamental frequency. The specifica- 
tion on the crystal was for a response (6 decibels down) only in the region within 

25 percent of the fundamental frequency. A tank circuit was placed after the crystal to 
attenuate spurious frequencies. 


Cable discoloration. - Several AEA Teflon-coated, shielded cables turned green 
and were replaced. The discoloration started at the connector end and extended up the 
cable. The chemically passive substance was a resin salt from the resin flux used in 
soldering. 


Thermal discoloration. - A classic thermal discoloration (purple plague) problem 
was encountered in the AEA program on the transistors having a gold-to-aluminum 
bond. The parts were replaced with substitutes having aluminum-to-aluminum internal 
bonds. 


Write pulse undershoot. - A memory loss problem occurred that was traced to the 
shape of the write pulse in the coincident current memory. The sharp fall time of the 
write pulse resulted in an undershoot that added to the inhibit pulse such that the state 
of the core could be changed. The timing circuitry was redesigned to slow the fall of 
the write pulse from 40 to 200 nanoseconds (1500-nanosecond pulse) and to eliminate 
the undershoot. 


Ceramic capacitors. - Ceramic capacitors had a workmanship/design fault in that 
the nailhead bond that connects the external leads to the ceramic slug did not have 
enough surface area (0.0152 square millimeters (30 mils)) to form a good bond, and 
the leads, under stress, broke off at the slug. The problem was compounded by the 
fact that the capacitor is square; after soldering to the board, twisting to make the 
capacitor lie flat caused tension on the leads. The ceramic capacitors were replaced. 


Sense amplifier transformers. - Six failures were encountered with one of the 
transformers because of lack of stress relief between the internal coil and the attaching 
lead. The problem was not discovered during part lot qualification testing because no 
stress was put on the lead until AEA installation. These parts were replaced. 


Split-pin wire wrapping. - The split-pin wire wrapping technique used to connect 
the terminals from the multilayer boards to the matrix board had an inherent flaw. 
The end of the wire wrapping was anchored into the barrel or hole in the matrix board 
through which the multilayer board pin extended, and the pin was then wire wrapped. 
This pigtail penetrated the silicone rubber of the matrix board and shorted to the adja- 
cent pin. Each AEA was rewrapped to eliminate this potential failure mode. 


Nylon washers. - The nylon washers used to support screws holding the bus bars 
in the AEA caused a problem. Cold flow of the nylon away from the screws allowed 
the screws to exert normal tension on the double bus bar configuration and resulted in 
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shearing of the nylon insulation and short circuiting of the two bus bar layers. The 
nylon washers were replaced with metal washers. - 


Read/write memory coupling. - An intermittent memory loss problem was dis- 
covered on several AEA units because of capacitive coupling between the read pulse and 
the write clock through a heat sink in the mounting multilayer board. The fall time of 
the read clock fell sharply in 40 nanoseconds and produced a coupling into a transistor 
that generated the write clock. The memory problem occurred because the write clock 
was initiated early by the falling read clock pulse. The proposed design change to 
correct this problem consisted of increasing the bias on the write transistor from 
1.5 to 4 milliamperes to overcome the 2-milliampere noise from the read clock. In 
the course of the investigation, however, another problem appeared 40 nanoseconds 
after the read clock cutoff. The fast fall of the read clock cut off a read driver so 
quickly that the back electromotive force (emf) of the stack inductance caused a transis- 
tor in the read driver to break down (30 volts applied base to emitter) under cold condi- 
tions (283 K (50° F)) in which the stack uses more current. The breakdown caused 
insertion of a pulse into the power system and triggering of the write pulse. To correct 
this problem, the read clock fall time was slowed to 150 nanoseconds, and a clamp was 
placed on the write clock transistor. 


Multilayer board repairs. - The need for an approved rework procedure for multi- 
layer boards to meet manufacturing schedule requirements became apparent early in 
the program. Haywiring was approved but was limited to five haywires per board; the 
restriction was later changed to seven per board. 


Glass resistors and diodes. - Longitudinal cracks were found in 11 glass resistors 
and diodes following qualification testing. The problem was traced to low-temperature 
exposure (244 K (-20° F)) used to simulate unpackaged ground handling. The thickness 
of the conformal coating was the cause of the problem. The thicker the coating, the 
greater the tendency for the components to crack. The electrical characteristics of 
the components were unaffected. Because the lower limit of the flight environment is 
273 K (32° F) and not a factor, a ground-handling restriction of 263 K (15° F) was 
established after testing to resolve the problem. 


Corrosion. - During a 2-week period of troubleshooting on one.AEA with the end 
plates removed and the cold rails intermittently operated, extensive internal corrosion 
developed because of moisture condensation. The gold flashing was penetrated, and 
aluminum oxide (nonconductive) and copper hydroxide (conductive) developed widely. 

A power supply short circuit developed because of the conductive copper hydroxide. 
Test procedures were changed to preclude recurrence of this problem. External AEA 
corrosion, aluminum oxide, was also noted in the field. The areas were cleaned and 
covered with a protective coating. 


Overheating. - During vacuum chamber testing on the LM test article 8 vehicle at 
MSC, the AFA sharply overheated and had to be turned off. Extensive analysis 
revealed that the AEA mounting screws did not firmly compress the AEA into the room- 
temperature vulcanizing (RTV) resulting in a separation of the thermal path between the 
AEA flanges and the cold rails. Because the AEA is the only box in the LM aft equip- 
ment bay with tapered coldplate flanges, special screws, which were omitted from the 
test, are only required for the AEA. 
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Noise. - During vehicle testing, the use of several measurements on the AEA GSE 
connector normally unused and unconnected was impossible because of noise on the 
lines. The problem was traced to coupling in the matrix board. Several GSE lines, 
which are stepped down in voltage 10:1, were run adjacent to a 4-volt flight telemetry 
line. The noise, 0.6 volt, was found on the same lines for several units tested. The 
noise had been undiscovered previously because the GSE lines were not used, and the 
AEA acceptance test only included waveform pictures of flight connector outputs. 
Waveforms of the GSE outputs of two AEA units were made to verify that the extent of 
the problem was limited to the noncritical lines measured. The noisy outputs were 
again removed from testing. 


Heat sinks. - Early in AEA production, problems encountered with burrs on metal 
heat sinks required that the sinks be returned to and reworked by the vendor. A filing 
process was not reliable in eliminating the burrs, and a grit blasting technique was 
adopted. The problem that burrs can create was illustrated by an intermittent memory 
problem, which was finally traced to a heat sink burr that penetrated the multilayer 
board on which it was mounted and short circuited to the first conductive layer below. 


Restarts. - Vehicle-level testing revealed that the AEA was subject to frequent 
restarts due to power transients resulting from circuit breaker actuations. The AEA 
was designed to shut off at 21.5 volts with a minimum transient capability of -100 volts 
for 10 microseconds, or an approximate 1000 volt-microseconds. The transients 
experienced in the vehicle were caused by the high internal impedance of the GSE power 
supplies used. Flight battery transients, under the same conditions, reduced the 
transients by an approximate factor of 5. Results of battery analysis determined that 
the AEA would not be shut off in flight; however, for additional protection, the AEA 
was connected to a second 28-volt direct-current bus, and diodes were installed 
between the two buses and the AEA. Because a potential single-point failure existed if 
a short circuit occurred at the AEA input that would drag down the second bus supplying 
the PGS (i.e., the AEA circuit breaker to that bus would not throw in the required 
time), the second bus connection was restricted from use until after a primary guid- 
ance failure. 


A restart of the AEA places the vehicle in attitude hold and. shuts off the engine. 
The undesirable engine-shutoff feature could not be eliminated without a hardware 
change because a flip-flop generating the off signal comes on at random when the AEA 
is energized and until memory control is established. This problem was circumvented 
by having the crewmen augment all automatic engine-on commands with an overriding, 
manual engine-on command that also had other desirable features of redundancy. 


Although a 1-volt line drop was added, the addition of the diodes provided another 
benefit in that negative transients to the AEA were eliminated and stored power could 
not be drained. Tests indicated that a 20-volt transient from 28 volts at the diode could 
be sustained for 560 microseconds before AEA shutoff. 
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Investigation of AEA restarts disclosed another factor potentially critical to AEA 
operation. The AEA normal current drain is 4 amperes, but 20 milliseconds after 
turn-on, when the memory is energized, an 8-ampere drain occurs for 10 milliseconds. 
A situation could occur, if the voltage did not rise above the AEA turn-on threshold of 
23.5 volts, in which the voltage drop produced by the memory turn-on could shut the 
AEA off and thus result in a cycling operation that could preclude operation and destroy 
the memory. The requirement that the bus voltage be 26. 2 volts at AEA turn-on, and 
following transients, was satisfied by the use of batteries. A vehicle bus alarm occurs 
at 26. 5 volts. 


Activation. - Operation of the AEA is controlled by an "off/standby/operate" 
switch in addition to a 28-volt circuit breaker. In the off and standby modes, a signal 
ground is returned to the AEA, and only a secondary AEA power supply is in operation 
to supply clock pulses to the ASA. Removal of the ground return places the AEA in 
operation. The break-before-make control switch, however, causes the AEA to go into 
operate momentarily between the off and standby switch positions. Contact bounce also 
produces the same effect. No detrimental effects were found in the use and special 
testing of the switch operation, although a power supply sequencing analysis indicated 
that the operation was undesirable for memory operation. An activation and deactiva- 
tion workaround that resulted in opening the AEA circuit breaker during switch opera- 
tion between off and standby was adopted. 


Alinement transients. - Alinement and calibration of the AEA to the primary 
system is made through three AEA integrator registers that receive and store pulses 
representing angular increments from coupling data units in the primary system. After 
a discharge time of 30 minutes, capacitor switching in the coupling data units produced 
momentary errors as large as 0. 2° to the AEA in response to angular rotations of 1.4°. 
Software and primary system hardware changes in the AEA were not feasible within 
program constraints. A 5-minute procedure for initially traversing 11.25° in each 
axis to close all capacitor switches was adopted for AEA IFC. Alinement of the AGS 
to the primary system, done instantaneously, is performed normally with crew and 
ground monitoring of the alinement accuracy. 


Functional electronic blocks. - Functional electronic blocks, packaged combina- 
tions of thin film networks and transistors, were built for the program by the AEA 
vendor. The components were initially enclosed in a hollow ceramic pack; however, 
breakage of leads, separation during vibration, and lack of seal integrity resulted ina 
redesign to encapsulate the components in a molded pack. Failures of the 96 functional 
electronic blocks in each AEA continued to be a problem. Early failures were due to 
defective transistors; however, two other failure mechanisms emerged. Short circuit- 
ing of internal wires to the thin film substrate and open interconnects due to spalling 
were the prime failure modes. The spalling, or chipping of the thin film substrate, 
was related to the use of adhesive for bonding within the functional electronic block 
(FEB). The rigidity of the adhesive, combined with the differential coefficients of 
thermal expansion of the FEB elements, produced the spalling. The spalling problem 
was corrected by the use of a different type of adhesive. The transistor type was 
changed and improved inspection procedures corrected the short circuiting to the 
substrate. 
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Data Entry and Display Assembly Development Problems 


The following significant problems were encountered in the development of the 
DEDA. 


Clock. - During testing, the 128 000-pulse/sec clock from the AEA to the DEDA 
caused DEDA malfunctions due to transmission line effects. A 2-microsecond clock 
pulse from the AEA triggers a 2-microsecond one-shot multivibrator in the DEDA 
input circuitry. An inflection on the trailing edge of the clock pulse produced by trans- 
mission line characteristics retriggered the DEDA one-shot multivibrator. The design 
correction shortened the AEA clock pulse from 2 microseconds to 1 microsecond. 


Electroluminescent display delamination. - Group B testing to qualify the EL part 
lots produced an EL failure that appeared as hemispherical chips from the edges of 
the display segments. The failure was due to loss of adhesion between the EL conduct- 
ing film and the glass surface. Low-temperature exposure caused the separation. 
The EL display was tested to a temperature of 225 K (-55° F) as part of the group B 
testing. No delamination was seen in the qualification unit that was exposed to a tem- 
perature of 244 K (-20° F), which was well below that of the flight environment. The 
suspect lot was pulled, and no further corrective action was taken other than inspecting 
all DEDA units for similar discrepancies. 


Electroluminescent display mounting. - A series of problems was encountered in 
mounting the EL display. A rubber gasket was initially placed over the EL display, 
and the display was forced against the front panel by a bracket. During vibration, the 
EL glass face cracked. In the second design, the EL display was bonded to a bracket 
that held the display away from the front panel. During qualification, the bond line 
between the bracket and the EL display cracked because of a difference in thermal 
expansion between the aluminum bracket and the Kovar of the EL display. (Kovar is 
necessary to match the thermal expansion of glass.) The bonding epoxy, selected 
because of the expansion difference, was too thin inthe cracked area. In addition, the 
EL display short circuited because of separation of the soluthane encapsulant from the 
back of the EL panel, allowing salt water to reach the connection pins. The corrective 
action was to control the epoxy thickness bonding the EL to the mounting bracket to 
greater than 0. 013 centimeter (0.005 inch), to place silicone rubber between the EL 
display and the front panel to form a gasket, to place silicone rubber on the sides and 
rear of the EL over the soluthane, and to remachine the front panel to eliminate any 
possibility of the EL display touching the panel. 


Electroluminescent display. - During qualification, six EL segments failed during 
a 4-hour period. The cause of failure was traced to a contaminant between the primary 
and secondary electrodes of the segments. The electrodes are deposited in sheets. 
The failure mode was a series of minute thermal explosions that blasted holes in the 
electrodes until the line of connection between the two was broken to cause an open 
circuit. The contaminant originated from an epoxy mound between the centers of the 
two overlapping electrode sheets used to support a bridging element that supplied power 
to the secondary electrode. In the silk-screening process for this lot of displays, 
initial misplacement of the screen necessitated removal and replacement of the epoxy, 
which resulted in smearing and a contaminant film. 
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Another EL display problem encountered in qualification was darkening of the 
segments because of a leak in the hermetically sealed display. The leak was caused 
by rework that stripped RTV from a pinhole in the solder seal. When power was 
applied, the moisture introduced caused an electrolysis effect that allowed zinc from 
zinc sulfide in an internal bonder to deposit around the phosphor. Darkening was 
immediate. Acceptance testing and normal operation were determined to be an ade- 
quate screen for leaks in the EL display. 


Switches. - The DEDA switches activated by each pushbutton are of the two-pole, 
double-throw type. Both contacts must close inthe numeric pushbutton switches for 
activation; but in such functions as clear, enter, and readout, one switch activates the 
DEDA and the other the AEA. This configuration was chosen for ground isolation. 
Because the switches must throw simultaneously (within 30 milliseconds) to prevent 
illumination of an "operator error" light, close tolerances were necessary in manufac- 
turing. Microswitch pairs were selected initially and adjusted after installation to 
throw within +0.0063 centimeter (+0.0025 inch). The electrical actuation was then 
determined not to vary more than 5 milliseconds. 


An anomaly during the LM-3 flight occurred when the pushbutton switch for clear 
operated intermittently because the AEA did not receive the discrete signal. For sub- 
sequent flights, a wiring change was made to the pushbutton switches for hold, enter, 
readout, and clear so that if either switch contact closed, both assemblies would 
receive the signal. This change introduced EMI problems, however, in that the DEDA 
became susceptible to coupled noise transients on the lines between the AEA and the 
DEDA. The 4-volt logic lines were injected with as much as 6 volts of peak-to-peak 
noise when various alternating-current circuit breakers were thrown in the spacecraft. 
The voltage drop caused by noise simulated pushbutton switch activation and caused the 
DEDA operator error light to illuminate. The operational procedure of clearing the 
DEDA after these occurrences was introduced. 


Pushbutton. - Binding of the DEDA pushbutton was observed on two assemblies to 
the extent that the pushbuttons would remain depressed until tapped. The problem was 
galling of the nylon pushbuttons by the stainless steel sleeve in which they rode. To 
correct the problem, the sticky pushbuttons were removed, and the sides were 
smoothed. In addition, a force criterion of 14 newtons (50 ounces) maximum was 
established for the sides and corners of the pushbutton to augment the center depression 
requirement of 4 to 8 newtons (15 to 30 ounces). 


Pushbutton leaks. - During vehicle thermal-vacuum tests at KSC, a phenomenon 
occurred because of leaks in the hermetically sealed DEDA pushbuttons. When the 
vacuum was broken, a pushbutton was depressed and then returned over a period of 
time. This condition was caused by pressure change: the sealed bellows assembly 
was evacuated during vacuum testing; after ambient conditions were regained, atmos- 
pheric pressure forced depression of the pushbutton. Because the leaks were small, 
pressurization of the bellows assembly was slow. Analysis and tests confirmed that 


this action would not take place in the mission environment of 39 985 N/m2 (5.8 psia). 
The DEDA vacuum acceptance test, which included a 1-hour leak test for the hermeti- 
cally sealed DEDA, was expanded to 5 hours to detect leaking pushbuttons, and all 
field DEDA units were vacuum screened. 
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Transformers. - Certain DEDA transformers in the 4-volt supply line from the 
AEA had reversed windings. This type transformer was used as an inductor, and the 
effect was to lower the phase margin of the feedback controlled loop to 4° and cause 
oscillations on the line because of the underdamped condition. The cause of the problem 
was attributed to improper workmanship in connecting the leads. The transformers 
were replaced. Because of the split of this power supply between the AEA and the 
DEDA, the phase margin of the power output was not tested in assembly. 


"Galloping eights"’.- A faint, flickering background illumination of the digit 8 in 
all EL digit windows ("galloping eights") was noticed when the EL intensity was maxi- 
mum inadark room. The illumination was not noticeable under normal lighting or 
with lower intensity (below 115 volts to the EL windows). The method by which the 
DEDA display is updated by the computer caused the problem. Twice-per-second data 
from the displayed memory location are fed serially through the data window to the 
address in the proper order. The result is to produce flickering of all EL segments as 
the data are shifted, giving the appearance of the figure 8. The possible design correc - 
tion was to blank the display during the period of AEA updating; however, this correc- 
tion was not considered necessary because the illumination did not interfere with 
reading the DEDA, even under worst-case lighting conditions. 


Abort Guidance System Software Development Problems 


The following significant changes and problems were encountered in the develop- 
ment of AGS software. 


Memory capacity. - The selection of a 4096-word memory was made with the 
knowledge that strong pressures would exist to expand the memory during the program. 
In early 1966, approximately 1 year after program inception and 3 years before flight, 
only 20 unassigned memory locations were available because of the requirements 
growth characteristic of program development. Because of skilled contractor program - 
ing and judicious selection of software functions, the mission changes were accommo- 
dated within the memory capacity. 


Radar filter.- The necessity for performing state vector updates with radar 
information initially resulted in a simple filter effective to a range of 185 kilometers 
(100 nautical miles). The mission change to the coelliptic flight plan changed the 
accuracy requirements because of longer ranges and a reduced fuel budget. Range-rate 
information was added to the existing range computations, and, to accommodate CSM 
ranges of 741 kilometers (400 nautical miles), the radar filter was redesigned. 


Design mission. - The AGS hardware is evaluated against three criteria for selloff 
or after a bench calibration: ASA specification values; predicted ASA performance after 
EPC, IFC, or lunar surface calibration (LSC); and AGS delta-V and pericynthion per- 
formance against an abort from hover design mission. By this means, the acceptability 
of out-of-specification ASA parameters may be determined. Maintaining a representa- 
tive design mission has proved exceedingly difficult because contractual action is 
required to change hardware criteria and mission definitions and techniques are 
extremely fluid. Significant changes to each flight have demonstrated that detailed 
mission criteria will remain obsolete and that a worst-case design mission must be 
selected and fixed for hardware evaluation. 
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Flight director attitude indicator computations sign.- A simple sign error in the 
transformation matrix for driving the flight director attitude indicator was found in 
vehicle testing and corrected. 


Direction cosine algorithm. - Interpretive computer simulations of the direction 
cosine algorithm determined that low angular rate limit-cycle conditions induced errors 
larger than the 0. 2-deg/hr error budgeted for software. The drift rates were caused 
by the quantization selected to meet the 25-deg/sec maximum angular rate and the 
constraints of an 18-bit word length. The solution was to change program scaling at 
low rates to reduce the quantization errors. The selected scaling switchover point was 
5.3 deg/sec; thus, three lower order bits were added below that rate. 


Hardwired memory. - The functions assigned to the hardwired half of the AEA 
memory were carefully selected to be mission independent. Two hardwired memory 
configurations were planned; however, three became necessary. The first memory 
configuration was established for preproduction units at a time when the memory 
requirements could not be fully defined. The second configuration was to meet all 
requirements, but the direction cosine algorithm change previously described resulted 
in a third hardwired memory for flight units. The hardwired memory had 53 escape 
points to the erasable memory for program patching as required. Limited use was 
made of the escape points in generating the flight program. 


External delta-V maneuver. - Orientation of the LM to a predicted, desired thrust 
attitude relative to a real-time local-horizon coordinate system became desirable. The 
capability was added to input through the DEDA down-range, cross-range, and radial 
velocity components to be burned; have the AGS orient the vehicle to the resultant 
vector; and then rotate the vehicle to maintain the vector with respect to local vertical. 
The Vo vector is frozen in inertial space by sensed thrust initiation. This mode also 


provides orbital-rate steering by using fictitious delta-V inputs that result in maintain+~ 
ing a fixed attitude relative to the surface. 


Communication maintenance. - The necessity for maintaining the S-band communi- 
cations locked on the Earth during powered descent and ascent required that the vehicle 
yaw angle be selectable. The equationfor the attitude error about the body X-axis was 
changed to allow this flexibility. 


Automatic exit from lunar aline. - The original implementation of lunar alinement 
allowed the mode to be maintained until ascent thrust was sensed, whereupon the atti- 
tude reference would go inertial. Inaccuracies due to loss of attitude pulse counts 
caused by the mechanism of the switchover resulted in the elimination of lunar aline- 
ment to save program steps. After the change, lunar aline was exited manually within 
4 minutes of lift-off and without significant attitude reference errors because of lunar 
rotation. 


Attitude update. - The mission capability of the AGS was taxed as the lunar landing 
mission became more complex. A navigation performance improvement was achieved 
by updating LM altitude through the DEDA during powered descent. An update between 
610 and 2134 meters (2000 and 7000 feet) of altitude, based on landing radar informa- 
tion, significantly improved navigational accuracy, even though the accuracy of the 
update was +305 meters (+1000 feet). 
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Insertion altitude. - The requirement that the AGS achieve a 9144-meter 
(30 000 foot) clear pericynthion orbit at insertion necessitated a change in the early 
concept of inserting at a 15 240-meter (50 000 foot) altitude. The insertion altitude was 
changed to 18 288 meters (60 000 feet). Because lunar landing sites could be several 
thousand feet below the mean lunar radius, another problem developed in achieving 
pericynthion. The pericynthion requirement was changed to be applicable to the landing 
site radius because pericynthion occurs near and behind insertion. 


Lunar module state vector initialization. - A mission procedure that was adopted 
to improve AGS accuracy was that of inserting a canned LM state vector, representative 
of LM conditions after landing, into the AEA before powered descent. On landing, the 
LM state vector was initialized by DEDA so that early aborts on AGS would benefit from 
improved navigation. 


Insertion targeting. - The original insertion targeting was based on a direct trans- 
fer trajectory to the CSM or on placement of the LM in a parking orbit of insertion alti- 
tude. This concept was changed to insertion target conditions of altitude, radial 
velocity, and horizontal velocity. These targets were revised to injection altitude, 
injection altitude rate, and orbit semimajor axis definition. Variable insertion target- 
ing was later introduced to automatically change the orbit at insertion based on the CSM 
phase angle. 


Lunar surface calibration. - The equations for lunar surface gyro calibration were 
initially simplified so that the inertial Y-axis was assumed to be within 10° of parallel 
with the lunar poles. With the adoption of inclined lunar orbits and landing sites off 
the lunar equator, errors were necessarily built up assuming all lunar rotation about 
the Y-axis. Three components of lunar rate compensation were added to replace the 
one required initially. 


Program timing improvement. - Verification testing of an early flight program 
indicated that a simulation automatic time alarm triggered at the set value of 
19.5 milliseconds. Because the maximum execution time allowable in a branch is 
20 milliseconds, a computational segment was moved to a less critical branch. 


Abort/abort-stage steering constraint. - As originally programed, presence of 
the abort or abort-stage discrete command was necessary for guidance steering. 
Because arming of the engines was produced by this action, even when RCS maneuvers 
were to be performed, the abort/abort-stage constraints on steering were removed. 


Angle to local horizontal. - During the LM-4 flight, the crewmen noted a discrep- 
ancy between the PGS and the AGS in that the angle between the Z-axis and the local 
horizontal calculated by the two systems disagreed. The AGS had computed the in-plane 
projection of the Z-axis and the local horizontal, whereas the primary system calcula- 
ted the actual angle. The AGS in-plane calculation was implemented to facilitate chart 
rendezvous solutions. Because the crewmen could recognize the difference, a change 
was not made to correct the calculation. 


Apofocus and perifocus. - The desirability of supplying the crewmen with more 
trajectory information than originally planned became evident. A change was instituted 
that would provide apofocus altitude and time until perifocus to complement the avail- 
able perifocus altitude. 
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Constant differential height maneuver. - To increase rendezvous flexibility, a 
change was made to enable performance of the CDH maneuver at either the first or 


third apsidal crossing, rather than only at the first crossing. 


Out-of-plane maneuvers. - For increased mission flexibility, performance of 
out-of-plane maneuvers at CSI and CDH to set up in-plane rendezvous became desirable. 
To provide this capability, the CSI and CDH calculations were expanded. 


Node after terminal phase initiate.- The direct transfer resulting from TPI was 
augmented by having the TPI maneuver create a node 90° down range. This maneuver 
allowed for performing a midcourse correction at the node to place the LM and the 
CSM in the same orbit plane for the remainder of the rendezvous. 


The AGS/PGNCS mechanical misalinement. - Because the critical alinement of 
the ASA and the PGS was controlled by mechanical interfaces, no hardware adjustment 
capability was provided. Alinement correction provisions were included originally in 
the software; however, because optical and accelerometer output alinement readings 
confirmed the integrity of the mechanical interface, the provision was deleted to obtain 
the memory locations. Similarly, a rendezvous radar boresight alinement compensa- 
tion provision was deleted. 


Radial jerk. - To eliminate excessive vehicle maneuvers during powered ascent, 
a steering constraint was implemented by limiting radial jerk “r° in the computations. 
The narrow limits imposed on ‘r’, however, reduced the capability of the LM to 


achieve the desired insertion conditions from a wide range of trajectory perturbations. 
A decision was made to allow larger off-nominal conditions to be removed when suffi- 


cient fuel was available. The “r’ computations were revised to make the limits on 


*r’ a function of vehicle configuration and thrust magnitude. 


Simulated flight. - During a simulated lunar ascent performed as part of vehicle 
checkout, an out-of-plane inertial velocity of 1.5 m/sec (5 ft/sec) was recorded, 
although body axis velocity did not record the out-of-plane component. The problem 
was traced to roundoff following transformation of the compensated sensed velocity 
from body to inertial coordinates in the 20-millisecond computing cycle. For simulated 
flight testing of the AGS, an accelerometer calibration was performed to compensate for 
accelerometer bias and input "gravity.'' The compensation is added to the accelerom- 
eter output data every 20 milliseconds, and the resulting compensated velocity is trans- 
formed to inertial coordinates, rounded, and rescaled. The error buildup resulted 
when the compensation, because of the particular value required for this vehicle orien- 
tation and accelerometer bias, was consistently rounded down in computation periods 
when an accelerometer pulse was not present. The flight effects in a dynamic environ- 
ment were negligible. To correct this problem, the effect of static roundoff error was 
calculated and included in test result evaluations. 


Capability Estimate 


Statistical summaries of measured AGS performance and error models for AGS 
evaluation are given in tables VII to X. The data were generaied fiom ensembic 
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information from 18 systems for 2 years. 


The error models defined the AGS perform- 


ance in the lunar mission after bench preinstallation calibration (PIC), EPC, IFC, and 
LSC. Time-~stability periods used were 60 days for PIC, 18 days for EPC, and 3 days 
for IFC and LSC. 
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TABLE VI. - ABORT GUIDANCE SYSTEM ERROR MODEL I CAPABILITY ESTIMATE* 


Error source 


Gyro static drift rate 
uncorrelated 


Gyro powered descent 
dynamic drift rate 


Gyro powered ascent dynamic 
drift rate 


Gyro coasting ascent dynamic 
drift rate 


Accelerometer bias, nonlinearity, 


eh c 
and vibration-induced error 


Gyro attitude scale-factor 
uncertainty 


Accelerometer scale-factor error 


| Gyro IA misalinement 


Accelerometer IA misalinement 


Initial attitude alinement error 


X, Y | arc-sec NA 
Z, Y NA 
Y, X | arc-sec NA 
Z, X NA 


Uniform 
max. value 


Gaussian 


310 x 107° | +94 x 1078 


310 +151 
310 


a 

PIC calibration of X-gyro SA mass unbalance, gyro scale factor, and accelerometer 
scale factor; IFC calibration of gyro bias and accelerometer bias; PGNCS aline; abort from 
end of hover. 


PNA = not applicable. 


“accelerometer bias, nonlinearity, and vibration-induced error are based on IFC with 
the RCS engines firing. With the RCS engines not firing, the X, Y, and Z bias values would 
reduce to 12lug, 1081:g, and 106g, respectively. 


TABLE VII. - ABORT GUIDANCE SYSTEM ERROR MODEL I CAPABILITY ESTIMATE” 


Uniform 
max. value 


Gaussian 


Unit 30 


Error source Axis Mean 


Gyro static drift rate x deg/hr 
(uncorrelated) Y 
Z 
Gyro powered descent D4 
dynamic drift rate Y 
Z 
Gyro powered ascent dynamic Xx 
drift rate Y 
Z 
Gyro coasting ascent dynamic ».¢ 
drift rate Y | 
z | 
Gyro drift mass unbalance ».¢ deg/hr NA 0.61 NA 
(correlated) 
Gyro SA mass unbalance X | deg/hr/g NA 0.57 NA 
(uncorrelated) 
Accelerometer bias, nonlinearity, ».¢ ve-4 NA_ | 190 NA 
: BS ea b Y NA_ {235 NA 
and vibration-induced error Zz NA 1233 NA 
Gyro attitude scale-factor x | deg/deg | NA |310x107°| +94 x10°6 
uncertainty Y NA_ |310 +151 
Z NA_ |310 +92 
Accelerometer scale-factor error Xx g/g 48 x 10° 65 xX 1076 NA 
Y 48 65 NA 
Zz 48 65 NA 
Gyro IA misalinement X, Y | arc-sec NA 1] 135 NA 
Zz, Y NA |178 NA 
Accelerometer IA misalinement Y, X | arc-sec NA |105 NA 
Z, X NA 69 NA 


Initial attitude alinement error arc-min 


».4 
Y 
Z 


*DIC calibration of X-gyro SA mass unbalance, gyro scale factor, and accelerometer 
scale factor; EPC calibration of gyro bias; IFC calibration of accelerometer bias; PGNCS 
aline; abort from end of hover. 


b ‘ ; ; d gi Fa 
The accelerometer bias, nonlinearity, and vibration-induced error are based on 


irC with the RCS engines firing. With the RCS engines not firing, the X, Y, and Z error 
magnitudes would reduce to 121lyg, 108g, and 106g, respectively. 
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TABLE IX. - ABORT GUIDANCE SYSTEM ERROR MODEL II CAPABILITY ESTIMATE 


Gaussian Uniform 
30 max. value 


deg/hr NA 0.43 


Error source Axis Unit 


Gyro static drift rate 
(uncorrelated) 


Gyro powered descent deg/hr 


dynamic drift rate 


ZZ 
>pP 
ib 
ne 


Gyro powered ascent dynamic 
drift rate 


Gyro coasting ascent dynamic 
drift rate 


Gyro drift mass unbalance 
(correlated) 


Gyro SA mass unbalance 
(uncorrelated) 


Accelerometer bias, nonlinearity, 
and vibration-induced error? 


Gyro attitude scale-factor deg/deg 310 x 10 
uncertainty 310 
310 
Accelerometer scale-factor error g/g 48 x1078| 65 x 10 NA 
48 65 NA 
48 65 NA 


Gyro IA misalinement 


arc-sec NA 135 NA 
NA 178 NA 

arc-sec NA 105 NA 
69 NA 


Accelerometer IA misalinement 


Initial attitude alinement error 


NX IT NM 
NwWM I” Y > NKKM INKM INS NKKMINKXM INK KI NK 

ax TK 
Qa 
@ 
R 
~S 
=a 
Le] 
™~ 
nR 


Zz 
> 


DIC calibration of X-gyro SA mass unbalance, gyro scale factor, and accelerometer 
scale factor; LSC calibration of gyro bias; IFC calibration of accelerometer bias; PGNCS 
aline; abort from lunar surface. 


Orme accelerometer bias, nonlinearity, and vibration-induced error are based on 
IFC with the RCS engines firing. With the RCS engines not firing, the X, Y, and Z error 
values would reduce to 128g, 118ug, and 116::g, respectively. 


TABLE X. - ABORT GUIDANCE SYSTEM ERROR MODEL IV CAPABILITY ESTIMATE* 


Enron source Gaussian Uniform 
30 max. value 
Gyro static drift rate NA 0. 70 


(uncorrelated) 
deg/hr 


Gyro powered descent 
dynamic drift rate 


Gyro powered ascent dynamic deg/hr NA 0.50 -- 
drift rate NA 27 +0. 37 
NA 48 -- 


Gyro coasting ascent dynamic 
drift rate 


Gyro drift mass unbalance 
(correlated) 


Gyro SA mass unbalance X | deg/hr/g NA 0.57 NA 
(uncorrelated) 
Accelerometer bias, nonlinearity,| X ug NA 163 NA 
and vibration-induced error Y NA 163 NA 
Z NA 163 NA 
Gyro attitude scale-factor x deg/deg NA 310x10°° | +94 x 1078 
uncertainty Y NA 310 +151 
Zz NA 310 +92 
Accelerometer scale-factor error| X g/g 48 x 10-8 65 x 1076 NA 
Y 48 65 NA 
Z 48 65 NA 
Gyro IA misalinement X, Y| arc-sec NA 135 NA 
Z, Y NA 178 NA 
Accelerometer IA misalinement Y, X | arc-sec NA 105 NA 
Z, X NA 69 NA 
Initial attitude alinement error x arc-min NA 7.57 NA 
Y NA 7.57 NA 
Z NA 7.57 NA 


4DIC calibration of X-gyro SA mass unbalance, gyro scale factor, accelerometer 
scale factor, and accelerometer bias; EPC calibration of gyro bias; PGNCS aline; abort 
from end of hover. 
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Flight Performance and Anomalies 
The overall flight performance of the AGS during the first three LM missions was 
good except for minor hardware malfunctions that did not interfere with mission opera- 
tions. Excellent inertial performance exceeded specification and capability estimate 
bounds. The detailed test objectives for the first three flights were as follows. 
1. AGS in-flight calibration and performance (detailed test objective (DTO) P12. 2) 


2. AGS/control electronics system (CES) attitude/translation control, unstaged 
LM (DTO P12. 3) 


3. AGS delta-V capability using the descent propulsion system (DTO P12. 4) 

4. AGS performance in the flight environment (DTO S12. 6) 

5. AGS/CES attitude/translation control, staged LM (DTO S12.8) 

6. Unmanned, AGS-controlled ascent propulsion system burn (DTO S12.9) 

7. LM AGS rendezvous evaluation (DTO S12. 10) 

8. PGNCS/AGS monitor lunar orbit (DTO P20. 82) 
All detailed test objectives were met after the AGS had been flown. 

The LM-3 flight (Apollo 9 mission). - The first flight test of the AGS was during 
the Apollo 9 mission (LM-3 flight). The AGS was operational throughout the mission 


and controlled a descent propulsion burn. The data recorded during the AGS calibra- 
tions are given in table XI. 


TABLE XI. - FINAL PIC, FINAL EPC, AND IFC DATA OF THE AGS 


Inertial 


instrument Final PIC | Final EPC 


Gyros 


X, deg/hr 
Y, deg/hr 


Z, deg/hr 
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The AGS performance and interface specification value for gyro-fixed drift after 
IFC is 0.6 deg/hr. The results of the in-flight accelerometer calibration were below 
the DEDA quantization level for Earth orbit, 380ug. The performance and interface 
specification requirement was 290ug after an IFC. The flight test results, in a dynamic 
environment, were well within the specified value, meeting DTO P12.2 requirements. 
Data recorded during the in-flight determination of gyro and accelerometer bias in free 
flight are given in table XII. The values were well within specification and satisfied 
the objectives of DTO $12.6. The PGNCS/AGS alinement accuracy (coupling data unit 
(CDU) and AEA angular differences) for three alinements is given in table XIII, which 


also demonstrates the performance of DTO S12.6. The alinement accuracy specifica- 
tion was 0. 067° 


TABLE XII. - IN-FLIGHT DETERMINATION OF GYRO AND 


ACCELEROMETER BIAS IN FREE FLIGHT 


Gyro Gyro drift relation In-flight 
axis to the PGNCS, deg/hr accelerometer bias, pg 


0.03 + 0.12 


-.14+ .12 
-10+ .12 


TABLE XIII. - ALINEMENT ACCURACIES 


OF THE PGNCS DURING THE APOLLO 9 MISSION 


Alinement, deg 


The performance of DTO P12.4 was demonstrated by the AGS control of the LM 
phasing burn. The Vo residual in the PGNCS after the burn was 0. 42 m/sec 


(1.38 ft/sec). The same residual for the AGS was 0.3 m/sec (1.0 ft/sec). A compari- 
son of the Ve magnitudes for all burns is given in table XIV. 
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TABLE XIV. - A COMPARISON OF THE 


Ve MAGNITUDES FOR ALL BURNS 


Velocity, m/sec (ft/sec) 


Docked 1.7 (5.5) 1.29 (4.24) 
Phasing .3 (1.0) .42 (1.38) 
Insertion .3 (1.0) . 21 (.70) 

CSI .4 (1.5) . 36 (1.18) 


The performance of DTO S12.10 was accomplished partly by the AGS guidance 
solutions for the rendezvous maneuver. A comparison of the AGS computed Ve with 


that calculated by the ground for the rendezvous maneuvers (table XV) showed a close 
correlation. 
TABLE XV. - A COMPARISON OF THE RENDEZVOUS MANEUVER 


VELOCITIES AS COMPUTED BY THE AGS AND THE GROUND 


Velocity, m/sec (ft/sec) 
Rendezvous maneuver 
AGS Ground solution 


26 (86) 25 (81) 


13 (42) 12.5 (41.1) 


6.5 (21) 6.8 (22. 2) 


The requirement of DTO S12. 3 was satisfied by vehicle manual control during 
the LM-3 mission. The AGS performed properly in providing attitude-hold capability 
in conjunction with the CES. 


Two anomalies occurred during the Apollo 9 mission. At AGS turn-on prepara- 
tory to the rendezvous phase, the AGS C&W light illuminated and remained on for the 
duration of the AGS active phase. The light could be activated by an overtemperature 
ASA, by out-of-specification ASA power supply voltages, and by an AEA test mode 
failure. Because the AEA self-test readout indicated that the computer was operating 
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properly and that the ASA was at the proper temperature (322 K (120° F)) and a good 
IFC indicated that the ASA power supplies were operating properly, the mission was 
continued. Subsequent AGS performance indicated that the decision was correct and 
that the failure was not integral to the ASA. Possible causes of the failure were an 
open line from one of three ASA power supply voltages to instrumentation, including 
opening a 339 K (150° F) thermistor in the 12-volt line for overtemperature warning; 
a short-circuited test-mode-fail transistor in the AEA; or several instrumentation 
failures. The exact cause of the operator error light was not determined but was 
ascribed to an instrumentation failure. 


The second anomaly was reported by the crewmen after the mission. Frequently 
during the mission, the DEDA operator error light would illuminate following a clearing 
operation in the readout mode. Several depressions of the pushbutton for clear 
were required to extinguish the light. The problem was traced by downlink information 
to failure of the AEA to get the discrete signal for clear. The pushbutton for clear 
activates two independent microswitches adjusted to 5 milliseconds actuation, which 
supply the discrete to the AEA and the DEDA. Ifthe AEA and the DEDA do not simul- 
taneously receive the discrete signal within 30 milliseconds, an operator error light 
results. The failure was ascribed to an intermittent switch operation or a mechanical 
shift in the switch that caused an activation timing error. Similarly, a previous one- 
time anomaly in pushbutton switch activation for clear during ground testing had been 
closed as failure to fully depress the pushbutton. 


The corrective action was to rewire the pushbutton switches supplying both the 
AEA and the DEDA. The pushbutton switches for clear, enter, readout, and hold were 
wired so that closure of either switch would supply the discrete signal to both the AEA 
and the DEDA. The DEDA acceptance test was changed to perform pushbutton switch 
activation in six positions and during low-level vibration. 


The LM-4 flight (Apollo 10 mission). - During the Apollo 10 mission (LM-4 flight), 
the AGS controlled undocking, staging, ascent propulsion burn to depletion, and wide 
and narrow dead band attitude-control tests. This mission, in conjunction with the 
Apollo 9 mission, exercised all AGS functions except orbital insertion guidance and 
lunar surface operations. Three AGS alinements to the PGNCS that resulted in 
CDU/AEA angular differences within the 0.067° specification are given in table XVI. 


TABLE XVI. - ALINEMENT ACCURACIES OF THE 


PGNCS DURING THE APOLLO 10 MISSION 


Alinement, deg 
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A calibration of gyro and accelerometer biases was not performed during the 
mission as scheduled. The calculated performance information given in table XVII sup- 
ports DTO 812.6. The accelerometer bias was taken during a 20-minute period across 
the phasing burn. 


TABLE XVII - GYRO AND ACCELEROMETER CALIBRATIONS 


Bias x Y Z 


Accelerometer bias, ug... 


Gyro bias, deg/hr 


Data from four state vector transfers from the PGNCS to the AGS provided the 
following accuracies in support of DTO 812.6: 457 meters (1500 feet), 0.09 m/sec 
(0. 3 ft/sec); 183 meters (600 feet), 0.2 m/sec (0.6 ft/sec); 152.5 meters (500 feet), 
0.4 m/sec (1.3 ft/sec); and 152.5 meters (500 feet), 0.09 m/sec (0.3 ft/sec). The 
AGS burn residuals in comparison with those of the PGNCS (table XVIII) indicated close 
agreement in support of DTO P20.82. The AGS targeted delta-V for the TPI maneuvers 
was 7.39 m/sec (24.25 ft/sec). The PGNCS target was 7.3 m/sec (24.1 ft/sec). 


TABLE XVIII. - A COMPARISON OF AGS AND PGNCS 


BURN RESIDUALS 


Velocity, m/sec (ft/sec) 


Phasing burn 


Insertion 


CDH 


TPI 
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The burn to completion on the AGS satisfied DTO $12.9. A burn of 1164 m/sec 
(3820 ft/sec) was performed. The largest AGS attitude error was 0.1°. The AGS burn 
residual was 232 m/sec (762 ft/sec). The PGNCS burn residual was 233 m/sec 
(765 ft/sec). A series of AGS wide and narrow dead band attitude-hold tests was per- 
formed after the burn to depletion to satisfy DTO S12. 8. 


Two anomalies occurred during the LM-4 flight. After undocking, the crewmen 
noted a discrepancy of 20° between the AGS angle of the vehicle Z-axis with respect to 
local horizontal and the angle displayed by the PGNCS. This discrepancy was caused 
by a difference in the way the angle was calculated inthe two systems. The actual 
Z-axis was used for the PGNCS calculation, whereas a projection of the Z-axis in the 
orbital plane was used for the AGS calculation. The AGS calculation had been changed 
to the in-plane projection to facilitate use of chart solutions. The second anomaly 
occurred at staging. A large attitude transient occurred at staging because of the AGS 
mode of control selected. The Z-axis steering, which points the LM Z-axis at the 
CSM, had been selected previously. When the system went into the automatic mode 
near staging in wide dead band, the vehicle reoriented to point the Z-axis at the CSM. 
Because a rate limit is not imposed in wide dead band, a rapid attitude excursion 
resulted. 


The LM-5 (Apollo 11 mission) lunar landing. - No active AGS burns were per- 
formed on the Apollo 11 mission (LM-5 flight); however, AGS burn solutions were 
obtained, and AGS solutions and burn residuals were compared with those of the PGNCS. 
The accuracies of five AGS alinements to the PGNCS are given in table XIX. Gyro-drift 
performance data (table XX) were obtained by one IFC and two lunar surface calibra- 
tions performed during the mission. The results were well within specification values 
and supported DTO 12.2. A graph of the gyro performance history is given in figure 4. 


TABLE XIX. - ALINEMENT ACCURACIES OF 


THE PGNCS DURING THE APOLLO 11 MISSION 


Alinement, deg 


Axis |_———————————]_——““_——— 
1 2 3 4 5 
».4 0.003 -0. 005 0.02 -0. 002 -0. 003 
Y .004 . 003 -. 006 -.001 . 005 
0 01 002 0 003 


a er a 
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Gyro bias, deg/hr 


TABLE XX.- GYRO-DRIFT PERFORMANCE DATA 


Drift performance, deg/hr 


Calibration 


PIC (June 2, 1969) 
Final EPC (June 28, 1969) 
IFC (July 20, 1969) 


LSC (July 20, 1969) 


LSC (July 21, 1969) 


= ASA cubebninactor acceptance The accelerometer bias in free flight 
© LM contractor /kKSC is given in table XXI. The results were 
OD UM contractor/KSC 148 4 es F : 
(Earth prelaunch calibration) well within specification values, supporting 
O UM-5 in-flight calibration — DTO 12.2. A graph of accelerometer per- 
© UW-5 lunar surface calibration 1 ‘ . A F A 
1 O W-5 lunar surface calibration 2 formance history 1S given 1n figure 5. 


sea f 


The AGS computation of the TPI burn 
was 7.3 m/sec (24 ft/sec); the PGNCS solu- 
tion was 7.6 m/sec (25.1 ft/sec). The AGS- 
computed CDH maneuver was 6.17 m/sec 
(20. 25 ft/sec) as compared to a pad load of 
6 m/sec (20 ft/sec). The AGS CSI solution 
was 15.4 m/sec (50.7 ft/sec) compared to 
a nominal 15.6 m/sec (51.5 ft/sec). The 
AGS orbital parameters after insertion were 
a 17.6- by 86. 3-kilometer (9.5 by 46.6 nau- 
tical mile) orbit; PGNCS had a 17.6- by 
87. 6-kilometer (9.5 by 47.3 nautical mile) 
orbit; and the Manned Space Flight Network 
had a 17.6- by 89.1-kilometer (9.5 by 
ae = SBMS TSaaE”, ET  e 48.1 nautical mile) orbit. These data sup- 

Time, days port DTO 812.10 and DTO P20. 82. 
ma Pil ll 7H em al Al oi 7H Bil 
1968 | 1969 


Z-axis 


Date 


Figure 4. - Gyro bias history. 
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Accelerometer bias, 1g 


TABLE XXI.- ACCELEROMETER BIAS IN FREE FLIGHT 


Calibration 


PIC (June 2, 1969) 


Free flight (July 20, 1969) 


— ASA Subcontractor acceptance 
© LM contractor/KSC 
O Free-flight data (Apollo 11, LM-5) 


X-axis 


Y-axis 


Z-axis 


0 40 80 120 160 200 240 280 
Time, days 


1 1 1 i 1 i 1 1 I iy 
Wl Wh Wl 2 3A 4 OAR ALBA 
1968 | 1969 

Date 


Figure 5.- Accelerometer bias history. 


Accelerometer bias, pg 


The AGS burn residuals compared 
with those of the PGNCS are given in 
table XXII. The AGS delta-V,, out-of-plane 


error at orbital insertion was caused by a 
0.087° data error in azimuth supplied to the 
AGS on the lunar surface. The AGS CDH 
residuals were 0.06, -0.06, and -0.09 m/ 
sec (0.2, -0.2, and -0.3 ft/sec). The burn 
residuals support DTO S12.6. 


One AGS anomaly occurred during the 
flight. At turn-on, one of the DEDA EL 
segments would not illuminate. The seg- 
ment in the upper left of the middle data 
digit prevented the crewmen from distin- 
guishing between a 3 anda 9. Research into 
component failure histories and testing did 
not disclose any precursor for the failure. 
The possibility of a pinhole leak, a delam- 
ination, or an electrode burnout was exam- 
ined and discarded. The failure was 
ascribed to a part failure or a broken wire 
in the segment driver circuit. The usage, 
population, and history of the parts indicated 
that the failure was an isolated case. The 
only corrective action taken was to turn the 
EL segments to full intensity briefly during 
the latter portion of the checkout flow at 
KSC. 
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TABLE XXII. - A COMPARISON OF BURN RESIDUALS 


Residual velocity, ; 
m/sec (ft/sec) 


Descent orbit insertion 


Delta-Vy -0. 03 (-0. 1) 0.03 (0.1) 
Delta-Vy -.06 (-. 2) wl (. 4) 
Delta-V, -.21 (-.7) .03 (.1) 


Orbit insertion 


Delta-V, ~0.03 (-0.1) 0.03 (0.1) 
Delta-V, 2.7 (8.9) .03 (.1) 
Delta-V, wl (. 5) 


CSI 


Delta-Vy -0. 06 (-0. 2) 
Delta-Vy ; .21 = (.7) 
Delta-V, : -.03 (-.1) 


PROGRAM OBSERVATIONS 


Schedule 


The development of the AGS strapped-down guidance system was scheduled for 
completion 1 year after project initiation. Optimistically, the first preproduction units 
were originally scheduled for delivery in the fall of 1965 following contractual agree- 
ment in October 1964 and program definition completion in January 1965. Some inter- 
face changes, however, were made as late as May 1965. The first unit was delivered 
in August 1966, although various design changes and recycling followed. In the develop- 
ment of a similar system, allowance of 18 months is not unrealistic. 
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Thermal-Vacuum Acceptance 


During the AGS program, thermal-vacuum testing screened as many failures as 
vibration testing. Both environments should be used in assembly acceptance testing, 
beginning preferably with vibration so that weaknesses found by vibration will be evi- 
dent during thermal-vacuum testing. 


Compatibility Testing 


The initial AGS deliveries were made on systems rather than on individual 
assemblies. After the normal acceptance test was performed on each assembly, spe- 
cial tests were performed with the units connected. When confidence was gained in the 
interface performance, the compatibility test was dropped. No significant problems 
were disclosed by compatibility testing. Compatibility testing could be performed as 
part of qualification or design-proof testing and eliminated from acceptance testing. 


Dual Source Procurement 


The procurement of critical parts from two sources was questioned during the 
initial phases of the AGS program because of the cost factor. However, numerous 
experiences in the program demonstrated the necessity of having an immediate alternate 
source of qualified parts to maintain a schedule-oriented program. 


Assembly Reliability 


The subcontractor satisfied the reliability goal specified for each assembly by 
performing the most extensive part lot screening tests (i.e., R, -level parts that are 


sample tested to destruction, 100-percent environmental tested, etc.) on the most 
numerous parts in the assembly or on those with least usage history. Those familiar 
parts used in small numbers on certain cases, although meeting military standard and 
program requirements, were only 100-percent electrically tested and 100-percent 
burned in (Ry -level parts). An element of risk in this procedure was that defective 


parts might be introduced and result in expensive replacement. The setting of a relia- 
bility number for paper analysis should be replaced by a more stringent minimum part 
lot acceptance test. 


Transient Protection 


To prevent restarting, a 28-volt input dropout protection of a minimum of 
1 second should be provided for each assembly of an inertial guidance system. Even 
with flight batteries of low internal impedance and excellent response characteristics, 
the protection was needed for vehicle operation with ground power supplies. The cutoff 
voltage should also be set as low as possible, preferably at 18 volts or below. A diode 
in the 28-volt line offered protection from negative transients and thus prevented loss 
of stored energy and increased time to turnoff after a power drop. The benefits froma 
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diode greatly exceeded the detrimental effect of the 1-volt line drop it produced. The 
computer software functions and the computer electrical design for startup power 
sequencing should include the requirement to accommodate immediate and automatic 
mission continuation after a power loss that causes a computer restart. 


Software Development 


The time required for a major software change, including verification, could be 
as long as 9 months for a full memory that required complete recoding. A longer time 
was required for a hardware change. 


Memory Functions 


The memory constraints of the AEA coupled with the expanding mission require- 
ments necessitated the exclusion of many desirable software capabilities so that AGS 
rendezvous with the CSM could be retained. The provision for in-flight dumping of the 
AEA memory was excluded, as was an in-flight loading capability. Both these functions 
are highly desirable for future programs. Where weight requirements are not strin- 
gent, provision for an auxiliary memory should be included even though memory 
requirements at the time of hardware definition are marginal. 


Scale-Factor Asymmetry 
For future strapped-down systems, a computer provision for separate scale- 
factor compensations for positive and negative rotations in each gyro channel should be 
provided. The rectification error caused by scale-factor asymmetry in a dynamic 
environment would then be largely eliminated. 
Electroluminescent Display 
The failure of an EL display hermetic seal and the resultant introduction of mois- 
ture will produce darkening of the entire multidigit display within an hour. Future 
designs should compartmentalize each digit so that only one will be lost if a leak occurs. 
Pushbuttons 
The DEDA pushbutton design allowed the nylon caps to rub against the stainless 


steel sleeve. In future designs, the pushbutton should be attached to the activation 
shaft to prevent the cap from touching the sides of the housing. 


Pushbutton Switches 


The DEDA pushbutton switches are dependent on mechanical tolerances to produce 
the simultaneous activation of two switches within a 30-millisecond time tolerance. A 
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single switch, or preferably a redundant switch operation, should be used in future 
designs for pushbutton switches. 


Environmental Testing 


The effect of moisture on the assembly and the resulting corrosion could not be 
determined adequately if heat was maintained on the assembly during the test. Salt 
spray and temperature/humidity environments should be performed with the unit opera- 
tive as well as inoperative. 


Ground-S upport-Equipment Heaters 


A single heating control subassembly was used in the GSE heaters for both flight 
and ground temperature maintenance. Although heater life is 10 000 hours, the inoper- 
ative ASA was maintained at a temperature of 289 K (60° F) and no failures occurred. 
The necessity to feed power into the ASA GSE connector for ground operations would 
result in powering the vehicle bus if the ASA circuit breaker was left open. A better 
design would incorporate separate GSE heaters to maintain inertial instrument tempera- 
tures during inoperative periods. 


Abort Sensor Assembly Mission Acceptance 


Three levels of criteria were used for ASA selloff and evaluation after a bench 
calibration. The first level was comparison with specification values; the second was 
calculation of the stability of the bias terms after EPC, IFC, or LSC; and the third was 
determination of the mission delta-V and pericynthion performance. Maintaining a 
current mission definition contractually was difficult in the extreme. To use the third 
criterion for waiver evaluation, the only feasible procedure was to select a represent- 
ative mission and not attempt to follow the fluctuations of mission planning. 


Abort Sensor Assembly 


After six production units of the inertial sensor assembly have been field tested 
to obtain ensemble data, the specification should be reevaluated and adjusted as neces- 
sary to make it conform to the capability of the system. By this means, the specifica- 
tion could be more useful in detecting unusual performance and incipient reliability 
problems. 


Gyro Fluid 
The mass unbalance shift effects ascribed to two-cut gyro fluid stratification in 


the ASA indicated that the use of a single-cut flotation fluid was preferable for future 
programs. 
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Gyro Resonant Frequency 


To preclude significant induced drift rates caused by HVSIR errors, the frequen- 
cies applied to the gyro spin and input axes by vehicle limit cycling and their phase 
relationships should be compared with the gyro resonant frequency early in the design 
definition phase of a future program. 


Engineering Model 


Because of schedule constraints, the AGS program did not include the use of an 
engineering model for design evaluation before committing to production. Many manu- 
facturing and circuit design problems could have been corrected early if budgetary and 
schedule constraints had permitted an engineering evaluation model. 


Assembly Cabling 


Because the LM spacecraft wiring was frozen early by rack mounting connectors 
for the subassemblies, pigtail cables were extended from the AEA. An alternative con- 
figuration that would have simplified the AEA design would have been to box mount the 
connectors and mate the spacecraft connectors to each unit. 


Vibration Transmissibility 
A vibration transmissibility of 10 was initially specified for all AGS assemblies. 
The AEA design required that the transmissibility be opened to 20, which was done with 
no adverse effects as proven by qualification. The use of 10-layer multilayer boards 
at this transmissibility factor was therefore also verified. 
Split-Pin Wire Wrapping 
Anchoring one end of the wire wrap in the barrel produced short circuiting to the 
next pin in the AEA. Future procedures should be corrected, as were those of the 
AEA, to eliminate pigtails on both ends of the wire wrap. 
Program Incentives 
The use of fee incentives on completion of qualification testing and deliveries of 
blocks of initial assemblies was helpful in maintaining and improving schedules for the 
AGS program. 
Capability Retention 
The staffing of capable subcontractor personnel at a minimum cost for failure 


closeout and repair following delivery of the last unit was a significant problem because 
unless desired individuals were maintained full time on the AGS program, they were 
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reassigned to other programs and might not be recalled in an acceptable time period. 

A possible solution is to require, contractually, at the inception of a major and signifi- 
cant program, that key individuals be made available on 2 weeks notice from production 
completion throughout the flight program. 


Subcontractor Test Participation 


The initial integration of the AGS with the LM presented many problems related 
to vehicle checkout. The participation of the subcontractor would have been valuable 
during the resolution of these problems. A review by the subcontractor of vehicle 
checkout procedures and onsite support during house spacecraft integration and the test 
of the first two flight vehicles would be beneficial in future programs; such a review 
would result in time savings that would outweigh the attendant costs. 


Program Control 


To ensure effective control of the technical and cost aspects of a subcontract by 
MSC subsystem personnel, the vendor change notices originated by the prime contractor 
to the subcontractor should be reviewed by MSC, preferably before implementation. 
Cost negotiations with the prime contractor for MSC-directed changes should also 
include subsystem technical personnel participation to ensure that the scope and the 
content of the change are properly defined in the negotiation. 


Earth-Orbit Software Programs 


The requirement to support both Earth-orbit and lunar missions resulted in a 
decision to supply one set of equations for both missions and to use rescaling to accom- 
modate both environments. For Earth missions, rescaling by a factor of 4 was used 
without significant performance degradation. This approach, besides the advantage of 
economy, offered verification Of the lunar mission equations in Earth orbit. In addi- 
tion, flexibility was gained to convert a scheduled lunar mission to an Earth-orbit 
mission during flight through the use of DEDA changes to selected constants. 


Test Programs 


The prime contractor was responsible for AGS test and checkout programs, 
although the flight software was supplied as Government-furnished equipment. The 
prime contractor was required, however, to supply all test programs to the software 
vendor for verification. In this manner, effective testing of the special programs was 
obtained to avert test delays and to ensure the integrity of test results. 


Mission Performance Analysis 
Performance analyses indicating adequate delta-V margin performed early in a 


program shouid be biased iv allow for vehicle weight growth and the resultant reduction 
in available delta-V. 
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Gyro Rundown Time 


The use of gyro rundown time as a reliability indicator was complicated in the 
ASA because the generated back emf caused all three gyros to run down in approxi- 
mately the same time. Future designs should provide for decoupling the three gyro 
wheels. 


Program Evaluation Reporting Technique 


The use of the program evaluation reporting technique (PERT) was not signifi- 
cantly valuable in the AGS program. By the time the subcontractor PERT was incor- 
porated into the prime contractor PERT and transmitted to MSC, the data were out of 
date. The usefulness of the PERT remained at the subcontractor facility, where it 
served as a program plan and noted existing constraints and requirements. 


Inertial Package Alinement 


A recommended addition to future strapped-down packages is an optics cube for 
alinement determination. The preinstallation ASA mounting-base alinement was deter - 
mined by optically shooting a fixture mounted in place of the ASA against a fixture 
mounted on the vehicle navigation base and against a fixture mounted in place of the 
PGS inertial measurement unit. After installation, the mechanical alinement was 
obtained by gravity leveling the primary gimbaled system and by comparing the CDU 
readings with the ASA accelerometer outputs. The tolerance was 4 arc-minutes. This 
procedure was adequate, but the capability for direct optical sightings should be pro- 
vided for future systems. 


Backup Guidance Definition 


The crew task and training load for operating a backup guidance system that is 
different from the PGS was not fully appreciated at the inception of the AGS program. 
The simple operation originally envisioned became more and more complex as the 
mission profile and the AGS software were defined. The DEDA addresses could not 
correspond numerically to similar PGS addresses, where applicable, because limited 
memory capacity dictated that the memory locations be assigned according to judicious 
programing rather than according to compatibility with the PGNCS. Every considera- 
tion in future hardware definition should be given to placing redundancy in the primary 
system rather than incorporating a separate and different backup guidance system. 


Nailhead Bond Capacitors 
Nailhead bond capacitors should be eliminated from future designs because of 


limited contact area between the lead and the slug. If used, 100-percent environmental 
testing and X-raying should be performed on each lot to detect marginal bonds. 
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Flight Connector Integrity 


A paramount original program objective was to maintain flight connections, once 
made. This objective resulted in a 120-day stability requirement on ASA inertial 
parameters because it was envisioned that no bench calibration could be made after 
beginning vehicle testing at KSC. In practice, the elimination of bench calibrations at 
KSC was not realistic because stability must be closely observed, selection of flight 
compensation constants must be made, and the ASA can be bench calibrated during 
periods of as many as 80 days when it is not required in the vehicle for checkout. 
During the testing of the vehicle at KSC, the ASA was calibrated three times at maxi- 
mum intervals of 30 days. 


Work Packages 


The use of the work package concept for program control at the subcontractor 
level was very effective. The tracking of work units accomplished, compared to man- 
hours budgeted and actual man-hours expended, provided great insight into both sched- 
ule and cost forecasts. This control procedure is highly recommended for future 
programs. 


Elapsed-Time Indicators and "'G" Balls 


Neither elapsed-time indicators nor "'G" balls were reliable in the AGS program. 
The timekeeping was erratic, and the 'G" balls, set at 15g, were often sprung after 
hardware shipment or transportation from room to room. Recording accelerometers 
should be used on handling and shipping devices. Proper packaging and handling was 
found to be the only viable means of assuring hardware protection during transportation. 


Checkout Meetings 


Organized monthly checkout meetings at KSC were extremely beneficial in the 
AGS program. Common discussion of test requirements, criteria, schedule, proce- 
dures, and problems among prime contractor, subcontractor, MSC, and KSC personnel 
was important in ensuring the integrity of the flight vehicle. 


Computer Startup Sequence 


In designing a computer startup sequence, particular attention should be given to 
the sequence of current requirements. In the design of the AEA, the memory was 
turned on 20 milliseconds after the logic to ensure memory integrity. The normal 
4-ampere load was increased to an 8-ampere mandatory load at memory activation. 
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It was feasible for the attendant line drop for memory activation to lower the input volt- 
age below the computer cutoff level; this practice resulted in computer on/off cycling 
for low bus voltage levels at computer turn-on. 


Operator Error Lights 


All operator error and warning lights should be placed on GSE outputs or teleme- 
try to time correlate the occurrence of failure indications for anomaly resolution. 


CONCLUDING REMARKS 


The feasibility of a strapped-down guidance system of inertial quality has been 
demonstrated in the lunar module program by the abort guidance system. The number 
of problems encountered were not inordinate for a new development of this type, and 
successful resolution of the problems resulted in remarkable performance during the 
lunar landing missions. Confidence has therefore been established in the application 
of strapped-down guidance systems for future space programs. 


Lyndon B. Johnson Space Center 
National Aeronautics and Space Administration 
Houston, Texas, October 18, 1974 
976-10-41-01-72 
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